Page MenuHomeFreeBSD

bnxt(4): Fix ioctls when user addresses are inaccessable.
ClosedPublic

Authored by brooks on Mar 2 2020, 11:15 PM.
Tags
None
Referenced Files
F110398578: D23933.diff
Mon, Feb 17, 9:11 PM
Unknown Object (File)
Wed, Feb 12, 10:47 PM
Unknown Object (File)
Sat, Feb 8, 1:57 PM
Unknown Object (File)
Sat, Feb 8, 1:07 PM
Unknown Object (File)
Sat, Feb 8, 12:36 PM
Unknown Object (File)
Sat, Feb 8, 10:59 AM
Unknown Object (File)
Tue, Jan 28, 5:29 AM
Unknown Object (File)
Mon, Jan 27, 5:45 PM
Subscribers

Details

Summary

Check copyin's error code (differ adding copyout checks at this time).

Don't directly access user memory in the switch statement.

Since bnxt_ioctl_data isn't all that big, use a stack allocation.

Diff Detail

Lint
Lint Passed
Unit
No Test Coverage
Build Status
Buildable 29763
Build 27601: arc lint + arc unit

Event Timeline

I would maybe do it as two commits (bnxt on its own)? I was going to suggest checking the copyin/copyout return errors in bnxt, but that's a non-trivial change worthy of its own commit if someone does it. The copyin in particular really should be checked to avoid using malloc garbage as inputs to the routines the ioctls invoke.

This revision is now accepted and ready to land.Mar 3 2020, 5:33 PM
  • Rebase
  • Check copyin's error code.
  • Don't free a stack pointer.
This revision now requires review to proceed.Mar 3 2020, 7:05 PM
This revision is now accepted and ready to land.Mar 3 2020, 10:39 PM