Commit f118e9ab authored Jun 22, 2013 by Chen Gang Committed by David S. Miller Jul 10, 2013

arch: sparc: kernel: check the memory length before use strcpy().



For the related next strcpy(), the destination length is less than 512,
but the source maximize length may be 'OPROMMAXPARAM' (4096) which is
more than 512.

One work flow may:
  openprom_sunos_ioctl() ->  if (cmd == OPROMSETOPT)
    getstrings() ->  will alloc buffer with size 'OPROMMAXPARAM'.
    opromsetopt() ->  devide the buffer into 'var' and 'value'
      of_set_property() -> pass
        prom_setprop() -> pass
          ldom_set_var()

And do not mind the additional 4 alignment buffer increasing, since
'sizeof(pkt) - sizeof(pkt.header)' is 4 alignment at least.

Signed-off-by: Chen Gang <gang.chen@asianux.com>
Signed-off-by: David S. Miller <davem@davemloft.net>

parent bfffbea1

arch/sparc/kernel/ds.c

+10 −0

Original line number	Diff line number	Diff line
		@@ -783,6 +783,16 @@ void ldom_set_var(const char var, const char value)
		char base, p;
		int msg_len, loops;

		if (strlen(var) + strlen(value) + 2 >
		sizeof(pkt) - sizeof(pkt.header)) {
		printk(KERN_ERR PFX
		"contents length: %zu, which more than max: %lu,"
		"so could not set (%s) variable to (%s).\n",
		strlen(var) + strlen(value) + 2,
		sizeof(pkt) - sizeof(pkt.header), var, value);
		return;
		}

		memset(&pkt, 0, sizeof(pkt));
		pkt.header.data.tag.type = DS_DATA;
		pkt.header.data.handle = cp->handle;

Admin message