linux-kernel - [patch] message/i2o: add sanity check

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Date:	Fri, 23 Jul 2010 13:47:06 +0200
From:	Dan Carpenter <error27@...il.com>
To:	linux-kernel@...r.kernel.org, Markus.Lidel@...dowconnect.com
Cc:	kernel-janitors@...r.kernel.org
Subject: [patch] message/i2o: add sanity check

We use "reply_size" to determine the size of the "reply" buffer.  These
days the "reply" buffer is just some context information, an error code,
and a bunch of zeroes.  We stopped using it for useful information four
years ago in dcceafe25a5f47 "[PATCH] I2O: Bugfixes"

This patch ensures that "reply" is large enough to hold the context
information.   In the current code if "reply_size" is zero that would
cause memory corruption when we save the error code:
	reply[4] = ((u32) rcode) << 24;

Signed-off-by: Dan Carpenter <error27@...il.com>

diff --git a/drivers/message/i2o/i2o_config.c b/drivers/message/i2o/i2o_config.c
index c4b117f..8b1d55e 100644
--- a/drivers/message/i2o/i2o_config.c
+++ b/drivers/message/i2o/i2o_config.c
@@ -817,6 +817,11 @@ static int i2o_cfg_passthru(unsigned long arg)
 	reply_size >>= 16;
 	reply_size <<= 2;
 
+	if (reply_size < 5 * sizeof(u32)) {
+		rcode = -EINVAL;
+		goto out;
+	}
+
 	reply = kzalloc(reply_size, GFP_KERNEL);
 	if (!reply) {
 		printk(KERN_WARNING "%s: Could not allocate reply buffer\n",
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/