d/freebsd-dev
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Don't access a user buffer directly from the kernel.

Browse Source 
The handle_string callback for the ENCIOC_SETSTRING ioctl was passing
a user pointer to memcpy().  Fix by using copyin() instead.

For ENCIOC_GETSTRING ioctls, the handler was storing the user pointer
in a CCB's data_ptr field where it was indirected by other code.  Fix
this by allocating a temporary buffer (which ENCIOC_SETSTRING already
did) and copying the result out to the user buffer after the CCB has
been processed.

Reviewed by:	kib
Obtained from:	CheriBSD
MFC after:	1 week
Sponsored by:	DARPA
Differential Revision:	https://reviews.freebsd.org/D24487
This commit is contained in:
John Baldwin 2020-04-21 17:47:05 +00:00
parent f2620e9ceb
commit 47e735aded
Notes: svn2git 2020-12-20 02:59:44 +00:00 
svn path=/head/; revision=360171
1 changed files with 10 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

12
sys/cam/scsi/scsi_enc_ses.c
View File

@ -2904,13 +2904,19 @@ ses_handle_string(enc_softc_t *enc, encioc_string_t *sstr, int ioc)
buf[1] = 0;
buf[2] = sstr->bufsiz >> 8;
buf[3] = sstr->bufsiz & 0xff;
memcpy(&buf[4], sstr->buf, sstr->bufsiz);
ret = copyin(sstr->buf, &buf[4], sstr->bufsiz);
if (ret != 0) {
ENC_FREE(buf);
return (ret);
}
break;
case ENCIOC_GETSTRING:
payload = sstr->bufsiz;
amt = payload;
buf = ENC_MALLOC(payload);
if (buf == NULL)
return (ENOMEM);
ses_page_cdb(cdb, payload, SesStringIn, CAM_DIR_IN);
buf = sstr->buf;
break;
case ENCIOC_GETENCNAME:
if (ses_cache->ses_nsubencs < 1)
@ -2950,6 +2956,8 @@ ses_handle_string(enc_softc_t *enc, encioc_string_t *sstr, int ioc)
return (EINVAL);
}
ret = enc_runcmd(enc, cdb, 6, buf, &amt);
if (ret == 0 && ioc == ENCIOC_GETSTRING)
ret = copyout(buf, sstr->buf, sstr->bufsiz);
if (ioc == ENCIOC_SETSTRING)
ENC_FREE(buf);
return (ret);