Project

General

Profile

Feature #2771

111: Check that integer underflow doesn't happen in call of copy_from_user(), copy_to_user() and others

Added by Evgeny Novikov over 8 years ago. Updated almost 6 years ago.

Status:
Open
Priority:
Normal
Start date:
04/19/2012
Due date:
% Done:

90%

Estimated time:
Published in build:

Description

Somebody can pass negative values as a number of bytes to be copied from user. But copy_from_user() (and some similar functions) expects unsigned long int value, so negative values will lead to integer underflow. This issue belongs to specific:check_params, but also can be treated as generic:int_overflow. Commit 064368f of linux-stable represents the issue. Model 111_2a will take care on it.
And in additional 111_2a check if number of bytes is less than buffer's size.

Links
Sample bugfixes 42f9f8d, 5c9843a, 064368f, 5934df9

History

#1

Updated by Evgeny Novikov over 8 years ago

Commit 2086fa6 of LDV master branch added 111_1a model, that successfully finds the issue before commit 064368f of linux-stable and safe after the commit.

#2

Updated by Alexey Khoroshilov over 8 years ago

  • Subject changed from Check that integer underflow doesn't happen in call of copy_from_user to 111: Check that integer underflow doesn't happen in call of copy_from_user
#3

Updated by Evgeny Novikov over 8 years ago

  • Priority changed from High to Normal

Reduce priority until we'll decide that it's high actually.

#4

Updated by Vladimir Gratinskiy about 8 years ago

  • Subject changed from 111: Check that integer underflow doesn't happen in call of copy_from_user to 111: Check that integer underflow doesn't happen in call of copy_from_user(), copy_to_user() and others
  • Description updated (diff)
  • Assignee changed from Evgeny Novikov to Vladimir Gratinskiy
  • % Done changed from 0 to 10
#5

Updated by Vladimir Gratinskiy about 8 years ago

  • % Done changed from 10 to 90
#6

Updated by Vladimir Gratinskiy about 8 years ago

  • Description updated (diff)
#7

Updated by Evgeny Novikov about 8 years ago

What is the difference between 111_1a and 111_2a models?

#8

Updated by Vadim Mutilin almost 6 years ago

  • Description updated (diff)

Also available in: Atom PDF