system/linux
system/linux
1
0
Fork 0
mirror of https://github.com/torvalds/linux synced 2024-09-22 12:26:27 +00:00
Code Issues Packages Projects Releases Wiki Activity

Staging: heci: fix userspace pointer mess

Browse source 
Fix userspace pointer mess.
 - In memcmp(), dest and src pointer should be both in kernel space.
 - Add (void __user *) modification before userspace pointer.

Signed-off-by: Dongxiao Xu <dongxiao.xu@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
This commit is contained in:
Dongxiao Xu 2009-05-31 14:43:35 +08:00 committed by Greg Kroah-Hartman
parent 7a80bfcd1f
commit 36e844671c
2 changed files with 15 additions and 9 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

9
drivers/staging/heci/heci_main.c
View file

@ -1140,9 +1140,12 @@ static ssize_t heci_write(struct file *file, const char __user *ubuf,
spin_lock(&file_ext->file_lock);
file_ext->sm_state = 0;
if ((length == 4) &&
((memcmp(heci_wd_state_independence_msg[0], ubuf, 4) == 0) ||
(memcmp(heci_wd_state_independence_msg[1], ubuf, 4) == 0) ||
(memcmp(heci_wd_state_independence_msg[2], ubuf, 4) == 0)))
((memcmp(heci_wd_state_independence_msg[0],
priv_write_cb->request_buffer.data, 4) == 0) ||
(memcmp(heci_wd_state_independence_msg[1],
priv_write_cb->request_buffer.data, 4) == 0) ||
(memcmp(heci_wd_state_independence_msg[2],
priv_write_cb->request_buffer.data, 4) == 0)))
file_ext->sm_state |= HECI_WD_STATE_INDEPENDENCE_MSG_SENT;
spin_unlock(&file_ext->file_lock);

15
drivers/staging/heci/io_heci.c
View file

@ -111,7 +111,7 @@ int heci_ioctl_get_version(struct iamt_heci_device *dev, int if_num,
rets = file_ext->status;
/* now copy the data to user space */
if (copy_to_user(k_msg.data, res_msg.data, res_msg.size)) {
if (copy_to_user((void __user *)k_msg.data, res_msg.data, res_msg.size)) {
rets = -EFAULT;
goto end;
}
@ -188,7 +188,7 @@ int heci_ioctl_connect_client(struct iamt_heci_device *dev, int if_num,
/* copy the message to kernel space -
* use a pointer already copied into kernel space
*/
if (copy_from_user(req_msg.data, k_msg.data, k_msg.size)) {
if (copy_from_user(req_msg.data, (void __user *)k_msg.data, k_msg.size)) {
rets = -EFAULT;
goto end;
}
@ -266,7 +266,8 @@ int heci_ioctl_connect_client(struct iamt_heci_device *dev, int if_num,
spin_unlock_bh(&dev->device_lock);
/* now copy the data to user space */
if (copy_to_user(k_msg.data, res_msg.data, res_msg.size)) {
if (copy_to_user((void __user *)k_msg.data,
res_msg.data, res_msg.size)) {
rets = -EFAULT;
goto end;
}
@ -320,7 +321,8 @@ int heci_ioctl_connect_client(struct iamt_heci_device *dev, int if_num,
DBG("successfully connected to FW client.\n");
rets = file_ext->status;
/* now copy the data to user space */
if (copy_to_user(k_msg.data, res_msg.data, res_msg.size)) {
if (copy_to_user((void __user *)k_msg.data,
res_msg.data, res_msg.size)) {
rets = -EFAULT;
goto end;
}
@ -394,7 +396,8 @@ int heci_ioctl_wd(struct iamt_heci_device *dev, int if_num,
/* copy the message to kernel space - use a pointer already
* copied into kernel space
*/
if (copy_from_user(req_msg.data, k_msg.data, req_msg.size)) {
if (copy_from_user(req_msg.data,
(void __user *)k_msg.data, req_msg.size)) {
rets = -EFAULT;
goto end;
}
@ -464,7 +467,7 @@ int heci_ioctl_bypass_wd(struct iamt_heci_device *dev, int if_num,
return -EMSGSIZE;
}
spin_unlock(&file_ext->file_lock);
if (copy_from_user(&flag, k_msg.data, 1)) {
if (copy_from_user(&flag, (void __user *)k_msg.data, 1)) {
rets = -EFAULT;
goto end;
}