diff options
| author | sbruno <sbruno@FreeBSD.org> | 2016-07-22 03:03:52 +0000 |
|---|---|---|
| committer | sbruno <sbruno@FreeBSD.org> | 2016-07-22 03:03:52 +0000 |
| commit | 12a626dd41e19152d56e21bc82f39feb921c3cfb (patch) | |
| tree | 616a35713fe17def613cbc3fdc6f3030463dda32 | |
| parent | a815cdb9d2deffe7fe686db30a11b52957d6328b (diff) | |
| download | FreeBSD-src-12a626dd41e19152d56e21bc82f39feb921c3cfb.zip FreeBSD-src-12a626dd41e19152d56e21bc82f39feb921c3cfb.tar.gz | |
MFC r298231
hptmv(4) Fix potential buffer overflow in hpt_set_info.
While here, adjust some whitespace and yeild some useful debug info.
This is untested on this hardware, testing requests to -scsi went
unanswered.
| -rw-r--r-- | sys/dev/hptmv/hptproc.c | 15 |
1 files changed, 11 insertions, 4 deletions
diff --git a/sys/dev/hptmv/hptproc.c b/sys/dev/hptmv/hptproc.c index 93eff51..946a224 100644 --- a/sys/dev/hptmv/hptproc.c +++ b/sys/dev/hptmv/hptproc.c @@ -290,7 +290,9 @@ hpt_set_info(int length) /* * map buffer to kernel. */ - if (piop->nInBufferSize+piop->nOutBufferSize > PAGE_SIZE) { + if (piop->nInBufferSize > PAGE_SIZE || + piop->nOutBufferSize > PAGE_SIZE || + piop->nInBufferSize+piop->nOutBufferSize > PAGE_SIZE) { KdPrintE(("User buffer too large\n")); return -EINVAL; } @@ -301,8 +303,13 @@ hpt_set_info(int length) return -EINVAL; } - if (piop->nInBufferSize) - copyin((void*)(ULONG_PTR)piop->lpInBuffer, ke_area, piop->nInBufferSize); + if (piop->nInBufferSize) { + if (copyin((void*)(ULONG_PTR)piop->lpInBuffer, ke_area, piop->nInBufferSize) != 0) { + KdPrintE(("Failed to copyin from lpInBuffer\n")); + free(ke_area, M_DEVBUF); + return -EFAULT; + } + } /* * call kernel handler. @@ -324,7 +331,7 @@ hpt_set_info(int length) else KdPrintW(("Kernel_ioctl(): return %d\n", err)); free(ke_area, M_DEVBUF); - return -EINVAL; + return -EINVAL; } else { KdPrintW(("Wrong signature: %x\n", piop->Magic)); return -EINVAL; |
