Skip to content

Commit ef87dbe

Browse files
megabugtorvalds
authored andcommitted
floppy: ignore kernel-only members in FDRAWCMD ioctl input
Always clear out these floppy_raw_cmd struct members after copying the entire structure from userspace so that the in-kernel version is always valid and never left in an interdeterminate state. Signed-off-by: Matthew Daley <mattd@bugfuzz.com> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
1 parent 89ca3b8 commit ef87dbe

File tree

1 file changed

+3
-3
lines changed

1 file changed

+3
-3
lines changed

Diff for: drivers/block/floppy.c

+3-3
Original file line numberDiff line numberDiff line change
@@ -3121,10 +3121,11 @@ static int raw_cmd_copyin(int cmd, void __user *param,
31213121
return -ENOMEM;
31223122
*rcmd = ptr;
31233123
ret = copy_from_user(ptr, param, sizeof(*ptr));
3124-
if (ret)
3125-
return -EFAULT;
31263124
ptr->next = NULL;
31273125
ptr->buffer_length = 0;
3126+
ptr->kernel_data = NULL;
3127+
if (ret)
3128+
return -EFAULT;
31283129
param += sizeof(struct floppy_raw_cmd);
31293130
if (ptr->cmd_count > 33)
31303131
/* the command may now also take up the space
@@ -3140,7 +3141,6 @@ static int raw_cmd_copyin(int cmd, void __user *param,
31403141
for (i = 0; i < 16; i++)
31413142
ptr->reply[i] = 0;
31423143
ptr->resultcode = 0;
3143-
ptr->kernel_data = NULL;
31443144

31453145
if (ptr->flags & (FD_RAW_READ | FD_RAW_WRITE)) {
31463146
if (ptr->length <= 0)

0 commit comments

Comments
 (0)