isdn/i4l: fetch the ppp_write buffer in one shot

BugLink: http://bugs.launchpad.net/bugs/1723145
[ Upstream commit 02388bf87f72e1d47174cd8f81c34443920eb5a0 ]

In isdn_ppp_write(), the header (i.e., protobuf) of the buffer is
fetched twice from userspace. The first fetch is used to peek at the
protocol of the message and reset the huptimer if necessary; while the
second fetch copies in the whole buffer. However, given that buf resides
in userspace memory, a user process can race to change its memory content
across fetches. By doing so, we can either avoid resetting the huptimer
for any type of packets (by first setting proto to PPP_LCP and later
change to the actual type) or force resetting the huptimer for LCP
packets.

This patch changes this double-fetch behavior into two single fetches
decided by condition (lp->isdn_device < 0 || lp->isdn_channel <0).
A more detailed discussion can be found at
https://marc.info/?l=linux-kernel&m=150586376926123&w=2

Signed-off-by: Meng Xu <mengxu.gatech@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Seth Forshee <seth.forshee@canonical.com>

diff --git a/drivers/isdn/i4l/isdn_ppp.c b/drivers/isdn/i4l/isdn_ppp.c
index 6c44609fd83a0f266df74b80bbe91f84b3bd4a67..cd2b3c69771a24b62a7952a8e7c626fde5459c6b 100644 (file)
--- a/drivers/isdn/i4l/isdn_ppp.c
+++ b/drivers/isdn/i4l/isdn_ppp.c
@@ -825,7 +825,6 @@ isdn_ppp_write(int min, struct file *file, const char __user *buf, int count)
        isdn_net_local *lp;
        struct ippp_struct *is;
        int proto;
-       unsigned char protobuf[4];
 
        is = file->private_data;
 
@@ -839,24 +838,28 @@ isdn_ppp_write(int min, struct file *file, const char __user *buf, int count)
        if (!lp)
                printk(KERN_DEBUG "isdn_ppp_write: lp == NULL\n");
        else {
-               /*
-                * Don't reset huptimer for
-                * LCP packets. (Echo requests).
-                */
-               if (copy_from_user(protobuf, buf, 4))
-                       return -EFAULT;
-               proto = PPP_PROTOCOL(protobuf);
-               if (proto != PPP_LCP)
-                       lp->huptimer = 0;
+               if (lp->isdn_device < 0 || lp->isdn_channel < 0) {
+                       unsigned char protobuf[4];
+                       /*
+                        * Don't reset huptimer for
+                        * LCP packets. (Echo requests).
+                        */
+                       if (copy_from_user(protobuf, buf, 4))
+                               return -EFAULT;
+
+                       proto = PPP_PROTOCOL(protobuf);
+                       if (proto != PPP_LCP)
+                               lp->huptimer = 0;
 
-               if (lp->isdn_device < 0 || lp->isdn_channel < 0)
                        return 0;
+               }
 
                if ((dev->drv[lp->isdn_device]->flags & DRV_FLAG_RUNNING) &&
                    lp->dialstate == 0 &&
                    (lp->flags & ISDN_NET_CONNECTED)) {
                        unsigned short hl;
                        struct sk_buff *skb;
+                       unsigned char *cpy_buf;
                        /*
                         * we need to reserve enough space in front of
                         * sk_buff. old call to dev_alloc_skb only reserved
@@ -869,11 +872,21 @@ isdn_ppp_write(int min, struct file *file, const char __user *buf, int count)
                                return count;
                        }
                        skb_reserve(skb, hl);
-                       if (copy_from_user(skb_put(skb, count), buf, count))
+                       cpy_buf = skb_put(skb, count);
+                       if (copy_from_user(cpy_buf, buf, count))
                        {
                                kfree_skb(skb);
                                return -EFAULT;
                        }
+
+                       /*
+                        * Don't reset huptimer for
+                        * LCP packets. (Echo requests).
+                        */
+                       proto = PPP_PROTOCOL(cpy_buf);
+                       if (proto != PPP_LCP)
+                               lp->huptimer = 0;
+
                        if (is->debug & 0x40) {
                                printk(KERN_DEBUG "ppp xmit: len %d\n", (int) skb->len);
                                isdn_ppp_frame_log("xmit", skb->data, skb->len, 32, is->unit, lp->ppp_slot);