From patchwork Mon Jun 24 16:05:03 2013 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Dan Carpenter X-Patchwork-Id: 253906 X-Patchwork-Delegate: davem@davemloft.net Return-Path: X-Original-To: patchwork-incoming@ozlabs.org Delivered-To: patchwork-incoming@ozlabs.org Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by ozlabs.org (Postfix) with ESMTP id 323B42C009D for ; Tue, 25 Jun 2013 02:05:25 +1000 (EST) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1752664Ab3FXQFU (ORCPT ); Mon, 24 Jun 2013 12:05:20 -0400 Received: from aserp1040.oracle.com ([141.146.126.69]:39239 "EHLO aserp1040.oracle.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1751152Ab3FXQFT (ORCPT ); Mon, 24 Jun 2013 12:05:19 -0400 Received: from ucsinet22.oracle.com (ucsinet22.oracle.com [156.151.31.94]) by aserp1040.oracle.com (Sentrion-MTA-4.3.1/Sentrion-MTA-4.3.1) with ESMTP id r5OG5HKF011349 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=OK); Mon, 24 Jun 2013 16:05:17 GMT Received: from aserz7021.oracle.com (aserz7021.oracle.com [141.146.126.230]) by ucsinet22.oracle.com (8.14.4+Sun/8.14.4) with ESMTP id r5OG5FVr015156 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO); Mon, 24 Jun 2013 16:05:16 GMT Received: from abhmt118.oracle.com (abhmt118.oracle.com [141.146.116.70]) by aserz7021.oracle.com (8.14.4+Sun/8.14.4) with ESMTP id r5OG5FhJ023529; Mon, 24 Jun 2013 16:05:15 GMT Received: from elgon.mountain (/41.202.233.183) by default (Oracle Beehive Gateway v4.0) with ESMTP ; Mon, 24 Jun 2013 09:05:14 -0700 Date: Mon, 24 Jun 2013 19:05:03 +0300 From: Dan Carpenter To: Andy Gospodarek Cc: netdev@vger.kernel.org, kernel-janitors@vger.kernel.org Subject: [patch] tehuti: using uninitialized data in bdx_ioctl_priv() Message-ID: <20130624160503.GC31984@elgon.mountain> MIME-Version: 1.0 Content-Disposition: inline User-Agent: Mutt/1.5.21 (2010-09-15) X-Source-IP: ucsinet22.oracle.com [156.151.31.94] Sender: netdev-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: netdev@vger.kernel.org If we "cmd == SIOCDEVPRIVATE" then we use data[] without initializing it. The most common case is that we would return -EOPNOTSUPP. The other case is that we'd end up reading and writing to randomish places. This requires CAP_SYS_RAWIO so it's not very bad. The fix is to not allow SIOCDEVPRIVATE because it doesn't work. I returned -EOPNOTSUPP instead of -ENOTTY because that's what is used in the rest of the file. Signed-off-by: Dan Carpenter --- This bug is several years old. -- To unsubscribe from this list: send the line "unsubscribe netdev" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html diff --git a/drivers/net/ethernet/tehuti/tehuti.c b/drivers/net/ethernet/tehuti/tehuti.c index 571452e..5d08f38 100644 --- a/drivers/net/ethernet/tehuti/tehuti.c +++ b/drivers/net/ethernet/tehuti/tehuti.c @@ -647,14 +647,16 @@ static int bdx_ioctl_priv(struct net_device *ndev, struct ifreq *ifr, int cmd) ENTER; DBG("jiffies=%ld cmd=%d\n", jiffies, cmd); - if (cmd != SIOCDEVPRIVATE) { - error = copy_from_user(data, ifr->ifr_data, sizeof(data)); - if (error) { - pr_err("can't copy from user\n"); - RET(-EFAULT); - } - DBG("%d 0x%x 0x%x\n", data[0], data[1], data[2]); + + if (cmd == SIOCDEVPRIVATE) + RET(-EOPNOTSUPP); + + error = copy_from_user(data, ifr->ifr_data, sizeof(data)); + if (error) { + pr_err("can't copy from user\n"); + RET(-EFAULT); } + DBG("%d 0x%x 0x%x\n", data[0], data[1], data[2]); if (!capable(CAP_SYS_RAWIO)) return -EPERM;