Gitweb:     
http://git.kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=2a79289e87f3b6487b5fd23c8569f32097057fb4
Commit:     2a79289e87f3b6487b5fd23c8569f32097057fb4
Parent:     85f0379aa0f9366bb6918e2e898a915231176fbd
Author:     Patrick Caulfeld <[EMAIL PROTECTED]>
AuthorDate: Thu Jan 17 10:25:28 2008 +0000
Committer:  David Teigland <[EMAIL PROTECTED]>
CommitDate: Wed Jan 30 11:04:43 2008 -0600

    dlm: Sanity check namelen before copying it
    
    The 32/64 compatibility code in the DLM does not check the validity of
    the lock name length passed into it, so it can easily overwrite memory
    if the value is rubbish (as early versions of libdlm can cause with
    unlock calls, it doesn't zero the field).
    
    This patch restricts the length of the name to the amount of data
    actually passed into the call.
    
    Signed-off-by: Patrick Caulfield <[EMAIL PROTECTED]>
    Signed-off-by: David Teigland <[EMAIL PROTECTED]>
---
 fs/dlm/user.c |   12 +++++++++---
 1 files changed, 9 insertions(+), 3 deletions(-)

diff --git a/fs/dlm/user.c b/fs/dlm/user.c
index eb61648..1acb4c5 100644
--- a/fs/dlm/user.c
+++ b/fs/dlm/user.c
@@ -82,7 +82,8 @@ struct dlm_lock_result32 {
 };
 
 static void compat_input(struct dlm_write_request *kb,
-                        struct dlm_write_request32 *kb32)
+                        struct dlm_write_request32 *kb32,
+                        int max_namelen)
 {
        kb->version[0] = kb32->version[0];
        kb->version[1] = kb32->version[1];
@@ -112,7 +113,11 @@ static void compat_input(struct dlm_write_request *kb,
                kb->i.lock.bastaddr = (void *)(long)kb32->i.lock.bastaddr;
                kb->i.lock.lksb = (void *)(long)kb32->i.lock.lksb;
                memcpy(kb->i.lock.lvb, kb32->i.lock.lvb, DLM_USER_LVB_LEN);
-               memcpy(kb->i.lock.name, kb32->i.lock.name, kb->i.lock.namelen);
+               if (kb->i.lock.namelen <= max_namelen)
+                       memcpy(kb->i.lock.name, kb32->i.lock.name,
+                              kb->i.lock.namelen);
+               else
+                       kb->i.lock.namelen = max_namelen;
        }
 }
 
@@ -529,7 +534,8 @@ static ssize_t device_write(struct file *file, const char 
__user *buf,
 
                if (proc)
                        set_bit(DLM_PROC_FLAGS_COMPAT, &proc->flags);
-               compat_input(kbuf, k32buf);
+               compat_input(kbuf, k32buf,
+                            count - sizeof(struct dlm_write_request32));
                kfree(k32buf);
        }
 #endif
-
To unsubscribe from this list: send the line "unsubscribe git-commits-head" in
the body of a message to [EMAIL PROTECTED]
More majordomo info at  http://vger.kernel.org/majordomo-info.html

Reply via email to