Skip to content

L
linux
Commit 737b59f7 authored by Randy Dunlap's avatar Randy Dunlap Committed by David S. Miller
Browse files
Options

[NET]: Audit copy_from_user checks in pktgen. 

Patch by Steffen Klassert <klassert@mathematik.tu-chemnitz.de>
parent 61c5652a
Hide whitespace changes
Inline Side-by-side
Showing with 19 additions and 10 deletions
net/core/pktgen.c
View file @ 737b59f7
...@@ -961,7 +961,8 @@ static int proc_write(struct file *file, const char *user_buffer, ...@@ -961,7 +961,8 @@ static int proc_write(struct file *file, const char *user_buffer,
if (len < 0) if (len < 0)
return len; return len;
memset(name, 0, sizeof(name)); memset(name, 0, sizeof(name));
copy_from_user(name, &user_buffer[i], len); if (copy_from_user(name, &user_buffer[i], len))
return -EFAULT;
i += len; i += len;
max = count -i; max = count -i;
...@@ -1091,18 +1092,20 @@ static int proc_write(struct file *file, const char *user_buffer, ...@@ -1091,18 +1092,20 @@ static int proc_write(struct file *file, const char *user_buffer,
if (len < 0) if (len < 0)
return len; return len;
memset(info->outdev, 0, sizeof(info->outdev)); memset(info->outdev, 0, sizeof(info->outdev));
copy_from_user(info->outdev, &user_buffer[i], len); if (copy_from_user(info->outdev, &user_buffer[i], len))
return -EFAULT;
i += len; i += len;
sprintf(result, "OK: odev=%s", info->outdev); sprintf(result, "OK: odev=%s", info->outdev);
return count; return count;
} }
if (!strcmp(name, "flag")) { if (!strcmp(name, "flag")) {
char f[32]; char f[32];
memset(f, 0, 32);
len = strn_len(&user_buffer[i], sizeof(f) - 1); len = strn_len(&user_buffer[i], sizeof(f) - 1);
if (len < 0) if (len < 0)
return len; return len;
copy_from_user(f, &user_buffer[i], len); memset(f, 0, 32);
if (copy_from_user(f, &user_buffer[i], len))
return -EFAULT;
i += len; i += len;
if (strcmp(f, "IPSRC_RND") == 0) { if (strcmp(f, "IPSRC_RND") == 0) {
info->flags |= F_IPSRC_RND; info->flags |= F_IPSRC_RND;
...@@ -1154,7 +1157,8 @@ static int proc_write(struct file *file, const char *user_buffer, ...@@ -1154,7 +1157,8 @@ static int proc_write(struct file *file, const char *user_buffer,
if (len < 0) if (len < 0)
return len; return len;
memset(info->dst_min, 0, sizeof(info->dst_min)); memset(info->dst_min, 0, sizeof(info->dst_min));
copy_from_user(info->dst_min, &user_buffer[i], len); if (copy_from_user(info->dst_min, &user_buffer[i], len))
return -EFAULT;
if(debug) if(debug)
printk("pg: dst_min set to: %s\n", info->dst_min); printk("pg: dst_min set to: %s\n", info->dst_min);
i += len; i += len;
...@@ -1166,7 +1170,8 @@ static int proc_write(struct file *file, const char *user_buffer, ...@@ -1166,7 +1170,8 @@ static int proc_write(struct file *file, const char *user_buffer,
if (len < 0) if (len < 0)
return len; return len;
memset(info->dst_max, 0, sizeof(info->dst_max)); memset(info->dst_max, 0, sizeof(info->dst_max));
copy_from_user(info->dst_max, &user_buffer[i], len); if (copy_from_user(info->dst_max, &user_buffer[i], len))
return -EFAULT;
if(debug) if(debug)
printk("pg: dst_max set to: %s\n", info->dst_max); printk("pg: dst_max set to: %s\n", info->dst_max);
i += len; i += len;
...@@ -1178,7 +1183,8 @@ static int proc_write(struct file *file, const char *user_buffer, ...@@ -1178,7 +1183,8 @@ static int proc_write(struct file *file, const char *user_buffer,
if (len < 0) if (len < 0)
return len; return len;
memset(info->src_min, 0, sizeof(info->src_min)); memset(info->src_min, 0, sizeof(info->src_min));
copy_from_user(info->src_min, &user_buffer[i], len); if (copy_from_user(info->src_min, &user_buffer[i], len))
return -EFAULT;
if(debug) if(debug)
printk("pg: src_min set to: %s\n", info->src_min); printk("pg: src_min set to: %s\n", info->src_min);
i += len; i += len;
...@@ -1190,7 +1196,8 @@ static int proc_write(struct file *file, const char *user_buffer, ...@@ -1190,7 +1196,8 @@ static int proc_write(struct file *file, const char *user_buffer,
if (len < 0) if (len < 0)
return len; return len;
memset(info->src_max, 0, sizeof(info->src_max)); memset(info->src_max, 0, sizeof(info->src_max));
copy_from_user(info->src_max, &user_buffer[i], len); if (copy_from_user(info->src_max, &user_buffer[i], len))
return -EFAULT;
if(debug) if(debug)
printk("pg: src_max set to: %s\n", info->src_max); printk("pg: src_max set to: %s\n", info->src_max);
i += len; i += len;
...@@ -1205,7 +1212,8 @@ static int proc_write(struct file *file, const char *user_buffer, ...@@ -1205,7 +1212,8 @@ static int proc_write(struct file *file, const char *user_buffer,
if (len < 0) if (len < 0)
return len; return len;
memset(valstr, 0, sizeof(valstr)); memset(valstr, 0, sizeof(valstr));
copy_from_user(valstr, &user_buffer[i], len); if (copy_from_user(valstr, &user_buffer[i], len))
return -EFAULT;
i += len; i += len;
for(*m = 0;*v && m < info->dst_mac + 6; v++) { for(*m = 0;*v && m < info->dst_mac + 6; v++) {
...@@ -1237,7 +1245,8 @@ static int proc_write(struct file *file, const char *user_buffer, ...@@ -1237,7 +1245,8 @@ static int proc_write(struct file *file, const char *user_buffer,
if (len < 0) if (len < 0)
return len; return len;
memset(valstr, 0, sizeof(valstr)); memset(valstr, 0, sizeof(valstr));
copy_from_user(valstr, &user_buffer[i], len); if (copy_from_user(valstr, &user_buffer[i], len))
return -EFAULT;
i += len; i += len;
for(*m = 0;*v && m < info->src_mac + 6; v++) { for(*m = 0;*v && m < info->src_mac + 6; v++) {
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment
GitLab Nexedi Edition | About GitLab | About Nexedi | 沪ICP备2021021310号-2 | 沪ICP备2021021310号-7