LU-9859 libcfs: double copy bug

[fs/lustre-release.git] / libcfs / libcfs / linux / linux-module.c

diff --git a/libcfs/libcfs/linux/linux-module.c b/libcfs/libcfs/linux/linux-module.c
index 839f932..9e724ae 100644 (file)
--- a/libcfs/libcfs/linux/linux-module.c
+++ b/libcfs/libcfs/linux/linux-module.c
@@ -23,7 +23,7 @@
  * Copyright (c) 2008, 2010, Oracle and/or its affiliates. All rights reserved.
  * Use is subject to license terms.
  *
- * Copyright (c) 2012, 2014, Intel Corporation.
+ * Copyright (c) 2012, 2017, Intel Corporation.
  */
 /*
  * This file is part of Lustre, http://www.lustre.org/
@@ -32,7 +32,9 @@
 
 #define DEBUG_SUBSYSTEM S_LNET
 
+#include <linux/fs.h>
 #include <linux/miscdevice.h>
+#include <linux/uaccess.h>
 #include <libcfs/libcfs.h>
 
 static inline size_t libcfs_ioctl_packlen(struct libcfs_ioctl_data *data)
@@ -107,7 +109,7 @@ int libcfs_ioctl_getdata(struct libcfs_ioctl_hdr **hdr_pp,
                         struct libcfs_ioctl_hdr __user *uhdr)
 {
        struct libcfs_ioctl_hdr   hdr;
-       int err = 0;
+       int err;
        ENTRY;
 
        if (copy_from_user(&hdr, uhdr, sizeof(hdr)))
@@ -136,10 +138,16 @@ int libcfs_ioctl_getdata(struct libcfs_ioctl_hdr **hdr_pp,
                RETURN(-ENOMEM);
 
        if (copy_from_user(*hdr_pp, uhdr, hdr.ioc_len))
-               GOTO(failed, err = -EFAULT);
+               GOTO(free, err = -EFAULT);
+
+       if ((*hdr_pp)->ioc_version != hdr.ioc_version ||
+               (*hdr_pp)->ioc_len != hdr.ioc_len) {
+               GOTO(free, err = -EINVAL);
+       }
 
        RETURN(0);
-failed:
+
+free:
        LIBCFS_FREE(*hdr_pp, hdr.ioc_len);
        RETURN(err);
 }