diff options
author | Linus Torvalds <torvalds@linux-foundation.org> | 2009-06-19 17:48:32 -0700 |
---|---|---|
committer | Linus Torvalds <torvalds@linux-foundation.org> | 2009-06-19 17:48:32 -0700 |
commit | fb20871a54961b82d35303b43452928186c1361d (patch) | |
tree | 1beeb39e45eda1c8b5893090904b583fceeb07ef /drivers/staging/p9auth/p9auth.c | |
parent | bee89ab228e6f51c4ddd3481b9bd491859a8ee7b (diff) | |
parent | c7a5d70796379e3d51d0c652fbe1634b81d3bbd5 (diff) |
Merge git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/staging-2.6
* git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/staging-2.6: (342 commits)
Staging: comedi: fix build errors
Staging: udlfb: update to version 0.2.3
Staging: udlfb: fix some sparse warnings.
Staging: udlfb: clean up checkpatch warnings in udlfb.c
Staging: udlfb: clean up checkpatch warnings in udlfb.h
Staging: udlfb: add udlfb driver to build
Staging: add udlfb driver
Staging: pata_rdc: remove pointless comments
Staging: pata_rdc: remove DRIVER macros
Staging: pata_rdc: remove dbgprintf macro
Staging: pata_rdc: remove broken flag
Staging: pata_rdc: fix build warnings
Staging: pata_rdc: use PCI_DEVICE
Staging: pata_rdc: remove function prototypes
Staging: pata_rdc: coding style fixes
Staging: pata_rdc: convert code to work in 2.6.29
Staging: pata_rdc: add driver to the build system
Staging: add pata_rdc driver
Staging: remove obsolete serqt_usb driver
Staging: serqt_usb2 add the driver to the build
...
Diffstat (limited to 'drivers/staging/p9auth/p9auth.c')
-rw-r--r-- | drivers/staging/p9auth/p9auth.c | 24 |
1 files changed, 23 insertions, 1 deletions
diff --git a/drivers/staging/p9auth/p9auth.c b/drivers/staging/p9auth/p9auth.c index 3cac89b26fa..9111dcba37a 100644 --- a/drivers/staging/p9auth/p9auth.c +++ b/drivers/staging/p9auth/p9auth.c @@ -180,8 +180,12 @@ static ssize_t cap_write(struct file *filp, const char __user *buf, if (down_interruptible(&dev->sem)) return -ERESTARTSYS; + user_buf_running = NULL; + hash_str = NULL; node_ptr = kmalloc(sizeof(struct cap_node), GFP_KERNEL); user_buf = kzalloc(count, GFP_KERNEL); + if (!node_ptr || !user_buf) + goto out; if (copy_from_user(user_buf, buf, count)) { retval = -EFAULT; @@ -193,11 +197,21 @@ static ssize_t cap_write(struct file *filp, const char __user *buf, * hashed capability supplied by the user to the list of hashes */ if (0 == iminor(filp->f_dentry->d_inode)) { + if (count > CAP_NODE_SIZE) { + retval = -EINVAL; + goto out; + } printk(KERN_INFO "Capability being written to /dev/caphash : \n"); hexdump(user_buf, count); memcpy(node_ptr->data, user_buf, count); list_add(&(node_ptr->list), &(dev->head->list)); + node_ptr = NULL; } else { + if (!cap_devices[0].head || + list_empty(&(cap_devices[0].head->list))) { + retval = -EINVAL; + goto out; + } /* * break the supplied string into tokens with @ as the * delimiter If the string is "user1@user2@randomstring" we @@ -208,6 +222,10 @@ static ssize_t cap_write(struct file *filp, const char __user *buf, source_user = strsep(&user_buf_running, "@"); target_user = strsep(&user_buf_running, "@"); rand_str = strsep(&user_buf_running, "@"); + if (!source_user || !target_user || !rand_str) { + retval = -EINVAL; + goto out; + } /* hash the string user1@user2 with rand_str as the key */ len = strlen(source_user) + strlen(target_user) + 1; @@ -224,7 +242,7 @@ static ssize_t cap_write(struct file *filp, const char __user *buf, retval = -EFAULT; goto out; } - memcpy(node_ptr->data, result, CAP_NODE_SIZE); + memcpy(node_ptr->data, result, CAP_NODE_SIZE); /* why? */ /* Change the process's uid if the hash is present in the * list of hashes */ @@ -299,6 +317,10 @@ static ssize_t cap_write(struct file *filp, const char __user *buf, dev->size = *f_pos; out: + kfree(node_ptr); + kfree(user_buf); + kfree(user_buf_running); + kfree(hash_str); up(&dev->sem); return retval; } |