LU-9859 libcfs: double copy bug

[fs/lustre-release.git] / libcfs / libcfs / linux / linux-module.c

diff --git a/libcfs/libcfs/linux/linux-module.c b/libcfs/libcfs/linux/linux-module.c
index 54be33a..9e724ae 100644 (file)
--- a/libcfs/libcfs/linux/linux-module.c
+++ b/libcfs/libcfs/linux/linux-module.c
@@ -15,11 +15,7 @@
  *
  * You should have received a copy of the GNU General Public License
  * version 2 along with this program; If not, see
- * http://www.sun.com/software/products/lustre/docs/GPLv2.pdf
- *
- * Please contact Sun Microsystems, Inc., 4150 Network Circle, Santa Clara,
- * CA 95054 USA or visit www.sun.com if you need additional information or
- * have any questions.
+ * http://www.gnu.org/licenses/gpl-2.0.html
  *
  * GPL HEADER END
  */
@@ -27,7 +23,7 @@
  * Copyright (c) 2008, 2010, Oracle and/or its affiliates. All rights reserved.
  * Use is subject to license terms.
  *
- * Copyright (c) 2012, 2014, Intel Corporation.
+ * Copyright (c) 2012, 2017, Intel Corporation.
  */
 /*
  * This file is part of Lustre, http://www.lustre.org/
@@ -36,10 +32,11 @@
 
 #define DEBUG_SUBSYSTEM S_LNET
 
+#include <linux/fs.h>
+#include <linux/miscdevice.h>
+#include <linux/uaccess.h>
 #include <libcfs/libcfs.h>
 
-#define LNET_MINOR 240
-
 static inline size_t libcfs_ioctl_packlen(struct libcfs_ioctl_data *data)
 {
        size_t len = sizeof(*data);
@@ -112,7 +109,7 @@ int libcfs_ioctl_getdata(struct libcfs_ioctl_hdr **hdr_pp,
                         struct libcfs_ioctl_hdr __user *uhdr)
 {
        struct libcfs_ioctl_hdr   hdr;
-       int err = 0;
+       int err;
        ENTRY;
 
        if (copy_from_user(&hdr, uhdr, sizeof(hdr)))
@@ -141,10 +138,16 @@ int libcfs_ioctl_getdata(struct libcfs_ioctl_hdr **hdr_pp,
                RETURN(-ENOMEM);
 
        if (copy_from_user(*hdr_pp, uhdr, hdr.ioc_len))
-               GOTO(failed, err = -EFAULT);
+               GOTO(free, err = -EFAULT);
+
+       if ((*hdr_pp)->ioc_version != hdr.ioc_version ||
+               (*hdr_pp)->ioc_len != hdr.ioc_len) {
+               GOTO(free, err = -EINVAL);
+       }
 
        RETURN(0);
-failed:
+
+free:
        LIBCFS_FREE(*hdr_pp, hdr.ioc_len);
        RETURN(err);
 }
@@ -172,7 +175,7 @@ static struct file_operations libcfs_fops = {
 };
 
 struct miscdevice libcfs_dev = {
-       LNET_MINOR,
-       "lnet",
-       &libcfs_fops
+       .minor  = MISC_DYNAMIC_MINOR,
+       .name   = "lnet",
+       .fops   = &libcfs_fops
 };