From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1753835Ab0IHTk2 (ORCPT ); Wed, 8 Sep 2010 15:40:28 -0400 Received: from mail-qy0-f181.google.com ([209.85.216.181]:55330 "EHLO mail-qy0-f181.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1753464Ab0IHTkW (ORCPT ); Wed, 8 Sep 2010 15:40:22 -0400 DomainKey-Signature: a=rsa-sha1; c=nofws; d=gmail.com; s=gamma; h=date:from:to:cc:subject:message-id:mail-followup-to:mime-version :content-type:content-disposition:user-agent; b=au+WifgHT5r7sdx/M4Ke6Me0r16lu3BGFKvLePhhnFgp2/NalEMxSn5EhukVLgkK7k oeyg2O8sZB7fxjpmY1USu1ERwKNYKUVJiXhNiU3XpAq8coQOcShAuv//9/DZWBpjmerr aUXJ6sVrtf15+e88pzsH8qJsoqYWuYUhsWKNk= Date: Wed, 8 Sep 2010 21:39:56 +0200 From: Dan Carpenter To: David Woodhouse Cc: Artem Bityutskiy , Ben Hutchings , H Hartley Sweeten , "Kirill A. Shutemov" , linux-mtd@lists.infradead.org, linux-kernel@vger.kernel.org, kernel-janitors@vger.kernel.org Subject: [patch] mtd: sanity check input Message-ID: <20100908193956.GB3463@bicker> Mail-Followup-To: Dan Carpenter , David Woodhouse , Artem Bityutskiy , Ben Hutchings , H Hartley Sweeten , "Kirill A. Shutemov" , linux-mtd@lists.infradead.org, linux-kernel@vger.kernel.org, kernel-janitors@vger.kernel.org MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline User-Agent: Mutt/1.5.18 (2008-05-17) Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org If "ur_idx" is wrong we could go past the end of the array. The "ur_idx" comes from root so it's not a huge deal, but adding a sanity check makes the code more robust. Signed-off-by: Dan Carpenter diff --git a/drivers/mtd/mtdchar.c b/drivers/mtd/mtdchar.c index a825002..9c00549 100644 --- a/drivers/mtd/mtdchar.c +++ b/drivers/mtd/mtdchar.c @@ -513,6 +513,9 @@ static int mtd_ioctl(struct file *file, u_int cmd, u_long arg) if (get_user(ur_idx, &(ur->regionindex))) return -EFAULT; + if (ur_idx >= mtd->numeraseregions) + return -EINVAL; + kr = &(mtd->eraseregions[ur_idx]); if (put_user(kr->offset, &(ur->offset)) From mboxrd@z Thu Jan 1 00:00:00 1970 From: Dan Carpenter Date: Wed, 08 Sep 2010 19:39:56 +0000 Subject: [patch] mtd: sanity check input Message-Id: <20100908193956.GB3463@bicker> List-Id: MIME-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit To: David Woodhouse Cc: Artem Bityutskiy , kernel-janitors@vger.kernel.org, linux-kernel@vger.kernel.org, H Hartley Sweeten , linux-mtd@lists.infradead.org, Ben Hutchings , "Kirill A. Shutemov" If "ur_idx" is wrong we could go past the end of the array. The "ur_idx" comes from root so it's not a huge deal, but adding a sanity check makes the code more robust. Signed-off-by: Dan Carpenter diff --git a/drivers/mtd/mtdchar.c b/drivers/mtd/mtdchar.c index a825002..9c00549 100644 --- a/drivers/mtd/mtdchar.c +++ b/drivers/mtd/mtdchar.c @@ -513,6 +513,9 @@ static int mtd_ioctl(struct file *file, u_int cmd, u_long arg) if (get_user(ur_idx, &(ur->regionindex))) return -EFAULT; + if (ur_idx >= mtd->numeraseregions) + return -EINVAL; + kr = &(mtd->eraseregions[ur_idx]); if (put_user(kr->offset, &(ur->offset)) From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-qy0-f177.google.com ([209.85.216.177]) by bombadil.infradead.org with esmtp (Exim 4.72 #1 (Red Hat Linux)) id 1OtQVK-00059r-9k for linux-mtd@lists.infradead.org; Wed, 08 Sep 2010 19:40:26 +0000 Received: by qyk8 with SMTP id 8so479950qyk.15 for ; Wed, 08 Sep 2010 12:40:21 -0700 (PDT) Date: Wed, 8 Sep 2010 21:39:56 +0200 From: Dan Carpenter To: David Woodhouse Subject: [patch] mtd: sanity check input Message-ID: <20100908193956.GB3463@bicker> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline Cc: Artem Bityutskiy , kernel-janitors@vger.kernel.org, linux-kernel@vger.kernel.org, H Hartley Sweeten , linux-mtd@lists.infradead.org, Ben Hutchings , "Kirill A. Shutemov" List-Id: Linux MTD discussion mailing list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , If "ur_idx" is wrong we could go past the end of the array. The "ur_idx" comes from root so it's not a huge deal, but adding a sanity check makes the code more robust. Signed-off-by: Dan Carpenter diff --git a/drivers/mtd/mtdchar.c b/drivers/mtd/mtdchar.c index a825002..9c00549 100644 --- a/drivers/mtd/mtdchar.c +++ b/drivers/mtd/mtdchar.c @@ -513,6 +513,9 @@ static int mtd_ioctl(struct file *file, u_int cmd, u_long arg) if (get_user(ur_idx, &(ur->regionindex))) return -EFAULT; + if (ur_idx >= mtd->numeraseregions) + return -EINVAL; + kr = &(mtd->eraseregions[ur_idx]); if (put_user(kr->offset, &(ur->offset))