diff options
| author | Scotty Bauer <sbauer@eng.utah.edu> | 2015-12-01 11:11:04 -0700 |
|---|---|---|
| committer | Mike Snitzer <snitzer@redhat.com> | 2016-01-05 16:10:14 -0500 |
| commit | ead3db62bf10fe143bec99e7b7ff370d7a6d23ef (patch) | |
| tree | 5a54e9e13d64aec4eebaa98a27bcb7dfc30d1431 | |
| parent | 18d03e8c25f173f4107a40d0b8c24defb6ed69f3 (diff) | |
| download | linux-dm-ead3db62bf10fe143bec99e7b7ff370d7a6d23ef.tar.gz | |
dm ioctl: do not directly deference user memory in check_version()
Notice: this object is not reachable from any branch.
Use copy_from_user() to safely access user-land memory.
Signed-off-by: Scotty Bauer <sbauer@eng.utah.edu>
Signed-off-by: Mike Snitzer <snitzer@redhat.com>
Cc: stable@vger.kernel.org
Notice: this object is not reachable from any branch.
| -rw-r--r-- | drivers/md/dm-ioctl.c | 8 |
1 files changed, 6 insertions, 2 deletions
diff --git a/drivers/md/dm-ioctl.c b/drivers/md/dm-ioctl.c index 80a4395432596..fa5bf545f0fba 100644 --- a/drivers/md/dm-ioctl.c +++ b/drivers/md/dm-ioctl.c @@ -1642,9 +1642,13 @@ static ioctl_fn lookup_ioctl(unsigned int cmd, int *ioctl_flags) static int check_version(unsigned int cmd, struct dm_ioctl __user *user) { uint32_t version[3]; + uint32_t __user *versionp; int r = 0; - if (copy_from_user(version, user->version, sizeof(version))) + if (copy_from_user(&versionp, &user->version, sizeof(versionp))) + return -EFAULT; + + if (copy_from_user(version, versionp, sizeof(version))) return -EFAULT; if ((DM_VERSION_MAJOR != version[0]) || @@ -1663,7 +1667,7 @@ static int check_version(unsigned int cmd, struct dm_ioctl __user *user) version[0] = DM_VERSION_MAJOR; version[1] = DM_VERSION_MINOR; version[2] = DM_VERSION_PATCHLEVEL; - if (copy_to_user(user->version, version, sizeof(version))) + if (copy_to_user(versionp, version, sizeof(version))) return -EFAULT; return r; |