linux-kernel - [PATCH 1/6] hwmon: (dell-smm) Fail in ioctl I8K_BIOS_VERSION when bios version is not a number

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Sat, 18 Jun 2016 00:54:44 +0200
From:	Pali Rohár <pali.rohar@...il.com>
To:	Jean Delvare <jdelvare@...e.com>,
	Guenter Roeck <linux@...ck-us.net>,
	Jan C Peters <jcpeters89@...il.com>,
	Thorsten Leemhuis <fedora@...mhuis.info>,
	David Santamaría Rogado <howl.nsp@...il.com>,
	Peter Saunderson <peteasa@...il.com>,
	Tolga Cakir <cevelnet@...il.com>,
	"Austin S. Hemmelgarn" <ahferroin7@...il.com>,
	Mario_Limonciello@...l.com,
	Gabriele Mazzotta <gabriele.mzt@...il.com>,
	Michał Kępień <kernel@...pniu.pl>,
	Dakota Whipple <dakotajaywhipple@...il.com>,
	Leon Yu <leon@...nyu.net>
Cc:	linux-hwmon@...r.kernel.org, linux-kernel@...r.kernel.org,
	Pali Rohár <pali.rohar@...il.com>
Subject: [PATCH 1/6] hwmon: (dell-smm) Fail in ioctl I8K_BIOS_VERSION when bios version is not a number

ABI of I8K_BIOS_VERSION ioctl can return only number. But new BIOS versions
contain also other characters, which does not fit into that ABI. So in case
of non digit values return -EINVAL.

Reported-by: Mario Limonciello <Mario_Limonciello@...l.com>
Signed-off-by: Pali Rohár <pali.rohar@...il.com>
---
 drivers/hwmon/dell-smm-hwmon.c |    5 +++++
 1 file changed, 5 insertions(+)

diff --git a/drivers/hwmon/dell-smm-hwmon.c b/drivers/hwmon/dell-smm-hwmon.c
index c43318d..480b2fa 100644
--- a/drivers/hwmon/dell-smm-hwmon.c
+++ b/drivers/hwmon/dell-smm-hwmon.c
@@ -35,6 +35,7 @@
 #include <linux/uaccess.h>
 #include <linux/io.h>
 #include <linux/sched.h>
+#include <linux/ctype.h>
 
 #include <linux/i8k.h>
 
@@ -387,6 +388,10 @@ i8k_ioctl_unlocked(struct file *fp, unsigned int cmd, unsigned long arg)
 
 	switch (cmd) {
 	case I8K_BIOS_VERSION:
+		if (!isdigit(bios_version[0]) || !isdigit(bios_version[1]) ||
+		    !isdigit(bios_version[2]))
+			return -EINVAL;
+
 		val = (bios_version[0] << 16) |
 				(bios_version[1] << 8) | bios_version[2];
 		break;
-- 
1.7.9.5