lkml.org 
[lkml]   [2018]   [Dec]   [25]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
Patch in this message
/
From
Subject[PATCH] fs: coda: fix a double-fetch case when copy data to req->uc_data
Date
"hdr" has been copied in from user space and "hdr.opcode" is checked.
The code copies it again. User space data between the two copies is
subject to modification if the user-space code is multithreaded and
malicious. The modification may invalidate the check. The fix avoids
copying the header from user space again.

Signed-off-by: Kangjie Lu <kjlu@umn.edu>
---
fs/coda/psdev.c | 5 ++++-
1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/fs/coda/psdev.c b/fs/coda/psdev.c
index fb4d1c654773..248d21f84b54 100644
--- a/fs/coda/psdev.c
+++ b/fs/coda/psdev.c
@@ -174,7 +174,10 @@ static ssize_t coda_psdev_write(struct file *file, const char __user *buf,
hdr.opcode, hdr.unique);
nbytes = req->uc_outSize; /* don't have more space! */
}
- if (copy_from_user(req->uc_data, buf, nbytes)) {
+ *((struct coda_in_hdr *)req->uc_data) = hdr;
+ if (copy_from_user(req->uc_data + sizeof(hdr),
+ buf + sizeof(hdr),
+ nbytes - sizeof(hdr))) {
req->uc_flags |= CODA_REQ_ABORT;
wake_up(&req->uc_sleep);
retval = -EFAULT;
--
2.17.2 (Apple Git-113)
\
 
 \ /
  Last update: 2018-12-25 20:21    [W:0.025 / U:1.580 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site