* [PATCH 2/2] libnvdimm: Out of bounds read in __nd_ioctl() [not found] <20200225161927.hvftuq7kjn547fyj@kili.mountain> @ 2020-02-25 16:20 ` Dan Carpenter 2020-02-25 17:40 ` Dan Williams 0 siblings, 1 reply; 2+ messages in thread From: Dan Carpenter @ 2020-02-25 16:20 UTC (permalink / raw) To: Dan Williams Cc: Vishal Verma, Dave Jiang, Ira Weiny, linux-nvdimm, linux-kernel, kernel-janitors The "cmd" comes from the user and it can be up to 255. It it's more than the number of bits in long, it results out of bounds read when we check test_bit(cmd, &cmd_mask). The highest valid value for "cmd" is ND_CMD_CALL (10) so I added a compare against that. Fixes: 62232e45f4a2 ("libnvdimm: control (ioctl) messages for nvdimm_bus and nvdimm devices") Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com> --- drivers/nvdimm/bus.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/drivers/nvdimm/bus.c b/drivers/nvdimm/bus.c index a8b515968569..09087c38fabd 100644 --- a/drivers/nvdimm/bus.c +++ b/drivers/nvdimm/bus.c @@ -1042,8 +1042,10 @@ static int __nd_ioctl(struct nvdimm_bus *nvdimm_bus, struct nvdimm *nvdimm, return -EFAULT; } - if (!desc || (desc->out_num + desc->in_num == 0) || - !test_bit(cmd, &cmd_mask)) + if (!desc || + (desc->out_num + desc->in_num == 0) || + cmd > ND_CMD_CALL || + !test_bit(cmd, &cmd_mask)) return -ENOTTY; /* fail write commands (when read-only) */ -- 2.11.0 ^ permalink raw reply related [flat|nested] 2+ messages in thread
* Re: [PATCH 2/2] libnvdimm: Out of bounds read in __nd_ioctl() 2020-02-25 16:20 ` [PATCH 2/2] libnvdimm: Out of bounds read in __nd_ioctl() Dan Carpenter @ 2020-02-25 17:40 ` Dan Williams 0 siblings, 0 replies; 2+ messages in thread From: Dan Williams @ 2020-02-25 17:40 UTC (permalink / raw) To: Dan Carpenter Cc: Vishal Verma, Dave Jiang, Ira Weiny, linux-nvdimm, Linux Kernel Mailing List, kernel-janitors On Tue, Feb 25, 2020 at 8:21 AM Dan Carpenter <dan.carpenter@oracle.com> wrote: > > The "cmd" comes from the user and it can be up to 255. It it's more > than the number of bits in long, it results out of bounds read when we > check test_bit(cmd, &cmd_mask). The highest valid value for "cmd" is > ND_CMD_CALL (10) so I added a compare against that. > > Fixes: 62232e45f4a2 ("libnvdimm: control (ioctl) messages for nvdimm_bus and nvdimm devices") > Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com> Looks good, applied. ^ permalink raw reply [flat|nested] 2+ messages in thread
end of thread, other threads:[~2020-02-25 17:40 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
[not found] <20200225161927.hvftuq7kjn547fyj@kili.mountain>
2020-02-25 16:20 ` [PATCH 2/2] libnvdimm: Out of bounds read in __nd_ioctl() Dan Carpenter
2020-02-25 17:40 ` Dan Williams
This is a public inbox, see mirroring instructions for how to clone and mirror all data and code used for this inbox; as well as URLs for NNTP newsgroup(s).