From 2129145d96c85b05b300d450a788f2d7688dc23b Mon Sep 17 00:00:00 2001 From: Dan Carpenter Date: Fri, 19 Jul 2019 14:48:12 -0400 Subject: [PATCH] LU-9859 libcfs: double copy bug The problem is that we copy hdr.ioc_len, we verify it, then we copy it again without checking to see if it has changed in between the two copies. This could result in an information leak. Linux-commit: 76bdaa161cd93d9c033bf6fe2b0a5661c8204441 Signed-off-by: Dan Carpenter Signed-off-by: Greg Kroah-Hartman Signed-off-by: James Simmons Change-Id: Ic9ae8c19d90a5547600f3775ed337394717b94e3 Reviewed-on: https://review.whamcloud.com/35574 Tested-by: jenkins Tested-by: Maloo Reviewed-by: Shaun Tancheff Reviewed-by: Andreas Dilger Reviewed-by: Neil Brown Reviewed-by: Oleg Drokin --- libcfs/libcfs/linux/linux-module.c | 12 +++++++++--- 1 file changed, 9 insertions(+), 3 deletions(-) diff --git a/libcfs/libcfs/linux/linux-module.c b/libcfs/libcfs/linux/linux-module.c index 7300af8..9e724ae 100644 --- a/libcfs/libcfs/linux/linux-module.c +++ b/libcfs/libcfs/linux/linux-module.c @@ -109,7 +109,7 @@ int libcfs_ioctl_getdata(struct libcfs_ioctl_hdr **hdr_pp, struct libcfs_ioctl_hdr __user *uhdr) { struct libcfs_ioctl_hdr hdr; - int err = 0; + int err; ENTRY; if (copy_from_user(&hdr, uhdr, sizeof(hdr))) @@ -138,10 +138,16 @@ int libcfs_ioctl_getdata(struct libcfs_ioctl_hdr **hdr_pp, RETURN(-ENOMEM); if (copy_from_user(*hdr_pp, uhdr, hdr.ioc_len)) - GOTO(failed, err = -EFAULT); + GOTO(free, err = -EFAULT); + + if ((*hdr_pp)->ioc_version != hdr.ioc_version || + (*hdr_pp)->ioc_len != hdr.ioc_len) { + GOTO(free, err = -EINVAL); + } RETURN(0); -failed: + +free: LIBCFS_FREE(*hdr_pp, hdr.ioc_len); RETURN(err); } -- 1.8.3.1