dlm: dlm/user.c input validation fixes

[pandora-kernel.git] / fs / dlm / user.c

diff --git a/fs/dlm/user.c b/fs/dlm/user.c
index 4f74154..c306045 100644 (file)
--- a/fs/dlm/user.c
+++ b/fs/dlm/user.c
@@ -24,8 +24,7 @@
 #include "lvb_table.h"
 #include "user.h"
 
-static const char *name_prefix="dlm";
-static struct miscdevice ctl_device;
+static const char name_prefix[] = "dlm";
 static const struct file_operations device_fops;
 
 #ifdef CONFIG_COMPAT
@@ -82,7 +81,8 @@ struct dlm_lock_result32 {
 };
 
 static void compat_input(struct dlm_write_request *kb,
-                        struct dlm_write_request32 *kb32)
+                        struct dlm_write_request32 *kb32,
+                        size_t count)
 {
        kb->version[0] = kb32->version[0];
        kb->version[1] = kb32->version[1];
@@ -94,7 +94,8 @@ static void compat_input(struct dlm_write_request *kb,
            kb->cmd == DLM_USER_REMOVE_LOCKSPACE) {
                kb->i.lspace.flags = kb32->i.lspace.flags;
                kb->i.lspace.minor = kb32->i.lspace.minor;
-               strcpy(kb->i.lspace.name, kb32->i.lspace.name);
+               memcpy(kb->i.lspace.name, kb32->i.lspace.name, count -
+                       offsetof(struct dlm_write_request32, i.lspace.name));
        } else if (kb->cmd == DLM_USER_PURGE) {
                kb->i.purge.nodeid = kb32->i.purge.nodeid;
                kb->i.purge.pid = kb32->i.purge.pid;
@@ -112,7 +113,8 @@ static void compat_input(struct dlm_write_request *kb,
                kb->i.lock.bastaddr = (void *)(long)kb32->i.lock.bastaddr;
                kb->i.lock.lksb = (void *)(long)kb32->i.lock.lksb;
                memcpy(kb->i.lock.lvb, kb32->i.lock.lvb, DLM_USER_LVB_LEN);
-               memcpy(kb->i.lock.name, kb32->i.lock.name, kb->i.lock.namelen);
+               memcpy(kb->i.lock.name, kb32->i.lock.name, count -
+                       offsetof(struct dlm_write_request32, i.lock.name));
        }
 }
 
@@ -236,12 +238,12 @@ void dlm_user_add_ast(struct dlm_lkb *lkb, int type)
        spin_unlock(&proc->asts_spin);
 
        if (eol) {
-               spin_lock(&ua->proc->locks_spin);
+               spin_lock(&proc->locks_spin);
                if (!list_empty(&lkb->lkb_ownqueue)) {
                        list_del_init(&lkb->lkb_ownqueue);
                        dlm_put_lkb(lkb);
                }
-               spin_unlock(&ua->proc->locks_spin);
+               spin_unlock(&proc->locks_spin);
        }
  out:
        mutex_unlock(&ls->ls_clear_proc_locks);
@@ -504,7 +506,7 @@ static ssize_t device_write(struct file *file, const char __user *buf,
 #endif
                return -EINVAL;
 
-       kbuf = kmalloc(count, GFP_KERNEL);
+       kbuf = kzalloc(count + 1, GFP_KERNEL);
        if (!kbuf)
                return -ENOMEM;
 
@@ -522,14 +524,14 @@ static ssize_t device_write(struct file *file, const char __user *buf,
        if (!kbuf->is64bit) {
                struct dlm_write_request32 *k32buf;
                k32buf = (struct dlm_write_request32 *)kbuf;
-               kbuf = kmalloc(count + (sizeof(struct dlm_write_request) -
+               kbuf = kmalloc(count + 1 + (sizeof(struct dlm_write_request) -
                               sizeof(struct dlm_write_request32)), GFP_KERNEL);
                if (!kbuf)
                        return -ENOMEM;
 
                if (proc)
                        set_bit(DLM_PROC_FLAGS_COMPAT, &proc->flags);
-               compat_input(kbuf, k32buf);
+               compat_input(kbuf, k32buf, count + 1);
                kfree(k32buf);
        }
 #endif
@@ -896,14 +898,16 @@ static const struct file_operations ctl_device_fops = {
        .owner   = THIS_MODULE,
 };
 
+static struct miscdevice ctl_device = {
+       .name  = "dlm-control",
+       .fops  = &ctl_device_fops,
+       .minor = MISC_DYNAMIC_MINOR,
+};
+
 int dlm_user_init(void)
 {
        int error;
 
-       ctl_device.name = "dlm-control";
-       ctl_device.fops = &ctl_device_fops;
-       ctl_device.minor = MISC_DYNAMIC_MINOR;
-
        error = misc_register(&ctl_device);
        if (error)
                log_print("misc_register failed for control device");