From: Arjan van de Ven Date: Tue, 15 Dec 2009 02:00:11 +0000 (-0800) Subject: floppy: Add an extra bound check on ioctl arguments X-Git-Url: https://git.karo-electronics.de/?a=commitdiff_plain;h=2886a8bdfa007053b414ab01741a98c18c376a85;p=linux-beck.git floppy: Add an extra bound check on ioctl arguments gcc is not convinced that the floppy.c ioctl has sufficient bound checks: In function `copy_from_user', inlined from `fd_copyin' at drivers/block/floppy.c:3080, inlined from `fd_ioctl' at drivers/block/floppy.c:3503: arch/x86/include/asm/uaccess_32.h:211: warning: call to `copy_from_user_overflow' declared with attribute warning: copy_from_user buffer size is not provably correct And frankly, as a human I have a hard time proving the same more or less (the size comes from the ioctl argument. humpf. maybe. the code isn't very nice) This patch adds an explicit check to make 100% sure it's safe, better than finding out later that there indeed was a gap. [akpm@linux-foundation.org: add WARN_ON()] Signed-off-by: Arjan van de Ven Acked-by: Ingo Molnar Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds --- diff --git a/drivers/block/floppy.c b/drivers/block/floppy.c index d41d7f018549..3266b4f65daa 100644 --- a/drivers/block/floppy.c +++ b/drivers/block/floppy.c @@ -3497,6 +3497,9 @@ static int fd_ioctl(struct block_device *bdev, fmode_t mode, unsigned int cmd, ((cmd & 0x80) && !capable(CAP_SYS_ADMIN))) return -EPERM; + if (WARN_ON(size < 0 || size > sizeof(inparam))) + return -EINVAL; + /* copyin */ CLEARSTRUCT(&inparam); if (_IOC_DIR(cmd) & _IOC_WRITE)