]> git.baikalelectronics.ru Git - kernel.git/commit
floppy: Add an extra bound check on ioctl arguments
authorArjan van de Ven <arjan@infradead.org>
Tue, 15 Dec 2009 02:00:11 +0000 (18:00 -0800)
committerLinus Torvalds <torvalds@linux-foundation.org>
Tue, 15 Dec 2009 16:53:25 +0000 (08:53 -0800)
commitd04cc88e0e2962148b1f32f0a1bb6585647a0a3a
tree6b3d10c16393da65f271fe7865feb4bae97e7674
parenta58cc3aa63e7c0050d42e54f9e017c4d1bb283b7
floppy: Add an extra bound check on ioctl arguments

gcc is not convinced that the floppy.c ioctl has sufficient bound checks:

In function `copy_from_user',
    inlined from `fd_copyin' at drivers/block/floppy.c:3080,
    inlined from `fd_ioctl' at drivers/block/floppy.c:3503:
    arch/x86/include/asm/uaccess_32.h:211:
warning: call to `copy_from_user_overflow' declared with attribute
warning: copy_from_user buffer size is not provably correct

And frankly, as a human I have a hard time proving the same more or less
(the size comes from the ioctl argument.  humpf.  maybe.  the code isn't
very nice)

This patch adds an explicit check to make 100% sure it's safe, better than
finding out later that there indeed was a gap.

[akpm@linux-foundation.org: add WARN_ON()]
Signed-off-by: Arjan van de Ven <arjan@linux.intel.com>
Acked-by: Ingo Molnar <mingo@elte.hu>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
drivers/block/floppy.c