Check copyin's error code (differ adding copyout checks at this time).
Don't directly access user memory in the switch statement.
Since bnxt_ioctl_data isn't all that big, use a stack allocation.
Differential D23933
bnxt(4): Fix ioctls when user addresses are inaccessable. brooks on Mar 2 2020, 11:15 PM. Authored by Tags None Referenced Files
Details Check copyin's error code (differ adding copyout checks at this time). Don't directly access user memory in the switch statement. Since bnxt_ioctl_data isn't all that big, use a stack allocation.
Diff Detail
Event TimelineComment Actions I would maybe do it as two commits (bnxt on its own)? I was going to suggest checking the copyin/copyout return errors in bnxt, but that's a non-trivial change worthy of its own commit if someone does it. The copyin in particular really should be checked to avoid using malloc garbage as inputs to the routines the ioctls invoke. |