From patchwork Sat Sep 26 18:51:14 2009 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Arjan van de Ven X-Patchwork-Id: 50264 Received: from vger.kernel.org (vger.kernel.org [209.132.176.167]) by demeter.kernel.org (8.14.2/8.14.2) with ESMTP id n8QIvbjm030035 for ; Sat, 26 Sep 2009 18:57:37 GMT Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1752924AbZIZSy1 (ORCPT ); Sat, 26 Sep 2009 14:54:27 -0400 Received: (majordomo@vger.kernel.org) by vger.kernel.org id S1752846AbZIZSyZ (ORCPT ); Sat, 26 Sep 2009 14:54:25 -0400 Received: from casper.infradead.org ([85.118.1.10]:36410 "EHLO casper.infradead.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1752691AbZIZSyW (ORCPT ); Sat, 26 Sep 2009 14:54:22 -0400 Received: from [83.119.188.87] (helo=localhost.localdomain) by casper.infradead.org with esmtpsa (Exim 4.69 #1 (Red Hat Linux)) id 1MrcPV-0002Uh-GY; Sat, 26 Sep 2009 18:54:21 +0000 Date: Sat, 26 Sep 2009 20:51:14 +0200 From: Arjan van de Ven To: Arjan van de Ven Cc: linux-kernel@vger.kernel.org, torvalds@linux-foundation.org, mingo@elte.hu, linux-wireless@vger.kernel.org Subject: [PATCH 3/9] Add bound checks in wext for copy_from_user Message-ID: <20090926205114.4ec62382@infradead.org> In-Reply-To: <20090926204951.424e567e@infradead.org> References: <20090926204951.424e567e@infradead.org> Organization: Intel X-Mailer: Claws Mail 3.7.2 (GTK+ 2.14.7; i386-redhat-linux-gnu) Mime-Version: 1.0 X-SRS-Rewrite: SMTP reverse-path rewritten from by casper.infradead.org See http://www.infradead.org/rpr.html Sender: linux-wireless-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-wireless@vger.kernel.org From: Arjan van de Ven Subject: [PATCH 3/9] Add bound checks in wext for copy_from_user CC: linux-wireless@vger.kernel.org The wireless extensions have a copy_from_user to a local stack array "essid", but both me and gcc have failed to find where the bounds for this copy are located in the code. This patch adds some basic sanity checks for the copy length to make sure that we don't overflow the stack buffer. Signed-off-by: Arjan van de Ven diff --git a/net/wireless/wext.c b/net/wireless/wext.c index 5b4a0ce..34beae6 100644 --- a/net/wireless/wext.c +++ b/net/wireless/wext.c @@ -773,10 +773,13 @@ static int ioctl_standard_iw_point(struct iw_point *iwp, unsigned int cmd, essid_compat = 1; else if (IW_IS_SET(cmd) && (iwp->length != 0)) { char essid[IW_ESSID_MAX_SIZE + 1]; + unsigned int len; + len = iwp->length * descr->token_size; - err = copy_from_user(essid, iwp->pointer, - iwp->length * - descr->token_size); + if (len > IW_ESSID_MAX_SIZE) + return -EFAULT; + + err = copy_from_user(essid, iwp->pointer, len); if (err) return -EFAULT;