linux-kernel - [PATCH 2/2] net/9p: Return error on read with NULL buffer

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-Id: <1287412853-24700-2-git-send-email-aneesh.kumar@linux.vnet.ibm.com>
Date:	Mon, 18 Oct 2010 20:10:53 +0530
From:	"Aneesh Kumar K.V" <aneesh.kumar@...ux.vnet.ibm.com>
To:	v9fs-developer@...ts.sourceforge.net
Cc:	linux-fsdevel@...r.kernel.org, linux-kernel@...r.kernel.org,
	Sanchit Garg <sancgarg@...ux.vnet.ibm.com>,
	"Aneesh Kumar K.V" <aneesh.kumar@...ux.vnet.ibm.com>
Subject: [PATCH 2/2] net/9p: Return error on read with NULL buffer

From: Sanchit Garg <sancgarg@...ux.vnet.ibm.com>

This patch ensures that a read(fd, NULL, 0 ) returns  EFAULT on a 9p file.

Signed-off-by: Sanchit Garg <sancgarg@...ux.vnet.ibm.com>
Signed-off-by: Aneesh Kumar K.V <aneesh.kumar@...ux.vnet.ibm.com>
---
 net/9p/client.c |   10 ++++++----
 1 files changed, 6 insertions(+), 4 deletions(-)

diff --git a/net/9p/client.c b/net/9p/client.c
index e141e46..d5344d8 100644
--- a/net/9p/client.c
+++ b/net/9p/client.c
@@ -1313,6 +1313,11 @@ p9_client_read(struct p9_fid *fid, char *data, char __user *udata, u64 offset,
 	rsize = fid->iounit;
 	if (!rsize || rsize > clnt->msize-P9_IOHDRSZ)
 		rsize = clnt->msize - P9_IOHDRSZ;
+	/*
+	 * A read with NULL user buffer cause EFAULT error
+	 */
+	if (!data && !udata)
+		return -EFAULT;
 
 	if (count < rsize)
 		rsize = count;
@@ -1333,16 +1338,13 @@ p9_client_read(struct p9_fid *fid, char *data, char __user *udata, u64 offset,
 
 	if (data) {
 		memmove(data, dataptr, count);
-	}
-
-	if (udata) {
+	} else {
 		err = copy_to_user(udata, dataptr, count);
 		if (err) {
 			err = -EFAULT;
 			goto free_and_error;
 		}
 	}
-
 	p9_free_req(clnt, req);
 	return count;
 
-- 
1.7.1

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/