zhang / rpms / kernel

Forked from rpms/kernel 5 years ago
Clone
e293be
32bit version of copy_from_user() requires that
e293be
compiler statically knows that buffer overflow won't occur.
e293be
These patch so that static analysis by the compiler succeeds.
e293be
e293be
diff -up ./drivers/isdn/hardware/avm/b1.c.cfu4 ./drivers/isdn/hardware/avm/b1.c
e293be
--- ./drivers/isdn/hardware/avm/b1.c.cfu4	2018-03-22 06:40:12.000000000 +0900
e293be
+++ ./drivers/isdn/hardware/avm/b1.c	2018-04-18 16:24:24.000000000 +0900
e293be
@@ -176,6 +176,8 @@ int b1_load_t4file(avmcard *card, capilo
e293be
 	}
e293be
 	if (left) {
e293be
 		if (t4file->user) {
e293be
+			if (left > sizeof(buf)) /* make copy_from_user happy */
e293be
+				return -EFAULT;
e293be
 			if (copy_from_user(buf, dp, left))
e293be
 				return -EFAULT;
e293be
 		} else {
e293be
@@ -224,6 +226,8 @@ int b1_load_config(avmcard *card, capilo
e293be
 	}
e293be
 	if (left) {
e293be
 		if (config->user) {
e293be
+			if (left > sizeof(buf)) /* make copy_from_user happy */
e293be
+				return -EFAULT;
e293be
 			if (copy_from_user(buf, dp, left))
e293be
 				return -EFAULT;
e293be
 		} else {
e293be
diff -up ./fs/binfmt_misc.c.cfu2 ./fs/binfmt_misc.c
e293be
--- ./fs/binfmt_misc.c.cfu2	2018-03-22 06:40:12.000000000 +0900
e293be
+++ ./fs/binfmt_misc.c	2018-04-18 14:19:53.000000000 +0900
e293be
@@ -396,12 +396,12 @@ static int parse_command(const char __us
e293be
 {
e293be
 	char s[4];
e293be
 
e293be
-	if (!count)
e293be
-		return 0;
e293be
 	if (count > 3)
e293be
 		return -EINVAL;
e293be
 	if (copy_from_user(s, buffer, count))
e293be
 		return -EFAULT;
e293be
+	if (!count)
e293be
+		return 0;
e293be
 	if (s[count-1] == '\n')
e293be
 		count--;
e293be
 	if (count == 1 && s[0] == '0')
e293be
diff -up ./net/core/pktgen.c.pkt ./net/core/pktgen.c
e293be
--- ./net/core/pktgen.c.pkt	2018-03-22 06:40:12.000000000 +0900
e293be
+++ ./net/core/pktgen.c	2018-04-18 20:13:43.000000000 +0900
e293be
@@ -881,6 +881,8 @@ static ssize_t pktgen_if_write(struct fi
e293be
 		return len;
e293be
 
e293be
 	memset(name, 0, sizeof(name));
e293be
+	if (len > sizeof(name))
e293be
+		return -EFAULT;
e293be
 	if (copy_from_user(name, &user_buffer[i], len))
e293be
 		return -EFAULT;
e293be
 	i += len;
e293be
@@ -1798,6 +1800,8 @@ static ssize_t pktgen_thread_write(struc
e293be
 		return len;
e293be
 
e293be
 	memset(name, 0, sizeof(name));
e293be
+	if (len > sizeof(name))
e293be
+		return -EFAULT;
e293be
 	if (copy_from_user(name, &user_buffer[i], len))
e293be
 		return -EFAULT;
e293be
 	i += len;
e293be
@@ -1828,6 +1832,8 @@ static ssize_t pktgen_thread_write(struc
e293be
 			ret = len;
e293be
 			goto out;
e293be
 		}
e293be
+		if (len > sizeof(f))
e293be
+			return -EFAULT;
e293be
 		if (copy_from_user(f, &user_buffer[i], len))
e293be
 			return -EFAULT;
e293be
 		i += len;
e293be
diff -up ./sound/core/seq/seq_clientmgr.c.cfu5 ./sound/core/seq/seq_clientmgr.c
e293be
--- ./sound/core/seq/seq_clientmgr.c.cfu5	2018-03-22 06:40:12.000000000 +0900
e293be
+++ ./sound/core/seq/seq_clientmgr.c	2018-04-18 18:57:48.000000000 +0900
e293be
@@ -2123,6 +2123,8 @@ static long snd_seq_ioctl(struct file *f
e293be
 	 */
e293be
 	size = _IOC_SIZE(handler->cmd);
e293be
 	if (handler->cmd & IOC_IN) {
e293be
+		if (size > sizeof(buf)) /* make copy_from_user happy */
e293be
+			return -EFAULT;
e293be
 		if (copy_from_user(&buf, (const void __user *)arg, size))
e293be
 			return -EFAULT;
e293be
 	}
e293be
diff -up ./kernel/sys.c.cfu ./kernel/sys.c
e293be
--- ./kernel/sys.c.cfu	2018-03-22 06:40:12.000000000 +0900
e293be
+++ ./kernel/sys.c	2018-04-16 13:03:32.000000000 +0900
e293be
@@ -2091,7 +2091,10 @@ static int prctl_set_mm_map(int opt, con
e293be
 		return error;
e293be
 
e293be
 	if (prctl_map.auxv_size) {
e293be
+		unsigned long arg4 = prctl_map.auxv_size;
e293be
 		memset(user_auxv, 0, sizeof(user_auxv));
e293be
+		if (arg4 > sizeof(user_auxv)) /* to make copy_from_user happy */
e293be
+			return -EFAULT;
e293be
 		if (copy_from_user(user_auxv,
e293be
 				   (const void __user *)prctl_map.auxv,
e293be
 				   prctl_map.auxv_size))
e293be
diff -up ./drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c.cfu3 ./drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c
e293be
--- ./drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c.cfu3	2018-03-22 06:40:12.000000000 +0900
e293be
+++ ./drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c	2018-04-18 15:54:52.000000000 +0900
e293be
@@ -4498,9 +4498,13 @@ int vmw_execbuf_ioctl(struct drm_device
e293be
 		u32 idx = array_index_nospec(arg.version - 1,
e293be
 					     DRM_VMW_EXECBUF_VERSION);
e293be
 
e293be
+		/* to make copy_from_user() happy, check bounds beforehand */
e293be
+		size_t copysize = copy_offset[idx] - copy_offset[0];
e293be
+		if (copysize > sizeof(arg.context_handle))
e293be
+			return -EFAULT;
e293be
 		if (copy_from_user(&arg.context_handle,
e293be
 				  (void __user *) (data + copy_offset[0]),
e293be
-				  copy_offset[idx] - copy_offset[0]) != 0)
e293be
+				  copysize) != 0)
e293be
 			return -EFAULT;
e293be
 	}
e293be