scsi: lpfc: Prevent lpfc_debugfs_lockstat_write() buffer overflow
A static code analysis tool flagged the possibility of buffer overflow when using copy_from_user() for a debugfs entry. Currently, it is possible that copy_from_user() copies more bytes than what would fit in the mybuf char array. Add a min() restriction check between sizeof(mybuf) - 1 and nbytes passed from the userspace buffer to protect against buffer overflow. Link: https://lore.kernel.org/r/20230301231626.9621-2-justintee8345@gmail.com Signed-off-by: Justin Tee <justin.tee@broadcom.com> Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
This commit is contained in:
Родитель
fe15c26ee2
Коммит
c6087b82a9
|
@ -2157,10 +2157,13 @@ lpfc_debugfs_lockstat_write(struct file *file, const char __user *buf,
|
|||
char mybuf[64];
|
||||
char *pbuf;
|
||||
int i;
|
||||
size_t bsize;
|
||||
|
||||
memset(mybuf, 0, sizeof(mybuf));
|
||||
|
||||
if (copy_from_user(mybuf, buf, nbytes))
|
||||
bsize = min(nbytes, (sizeof(mybuf) - 1));
|
||||
|
||||
if (copy_from_user(mybuf, buf, bsize))
|
||||
return -EFAULT;
|
||||
pbuf = &mybuf[0];
|
||||
|
||||
|
@ -2181,7 +2184,7 @@ lpfc_debugfs_lockstat_write(struct file *file, const char __user *buf,
|
|||
qp->lock_conflict.wq_access = 0;
|
||||
}
|
||||
}
|
||||
return nbytes;
|
||||
return bsize;
|
||||
}
|
||||
#endif
|
||||
|
||||
|
|
Загрузка…
Ссылка в новой задаче