gcc/testsuite/gcc.dg/plugin/taint-CVE-2011-0521-1.c

   1 /* { dg-do compile } */
   2 /* { dg-additional-options "-Wno-pedantic" } */
   3 /* { dg-require-effective-target analyzer } */
   4
   5 /* See notes in this header.  */
   6 #include "taint-CVE-2011-0521.h"
   7
   8 /* Adapted from drivers/media/dvb/ttpci/av7110_ca.c  */
   9
  10 int dvb_ca_ioctl(struct file *file, unsigned int cmd, void *parg)
  11 {
  12         struct dvb_device *dvbdev = file->private_data;
  13         struct av7110 *av7110 = dvbdev->priv;
  14         unsigned long arg = (unsigned long) parg;
  15
  16         /* case CA_GET_SLOT_INFO:  */
  17         {
  18                 ca_slot_info_t *info=(ca_slot_info_t *)parg;
  19
  20                 if (info->num > 1)
  21                         return -EINVAL;
  22                 av7110->ci_slot[info->num].num = info->num; /* { dg-warning "attacker-controlled value" "" { xfail *-*-* } } */
  23                 av7110->ci_slot[info->num].type = FW_CI_LL_SUPPORT(av7110->arm_app) ?
  24                                                         CA_CI_LINK : CA_CI;
  25                 memcpy(info, &av7110->ci_slot[info->num], sizeof(ca_slot_info_t));
  26         }
  27         return 0;
  28 }
  29
  30 static struct dvb_device dvbdev_ca = {
  31         .priv           = NULL,
  32         /* [...snip...] */
  33         .kernel_ioctl   = dvb_ca_ioctl,
  34 };
  35
  36 /* Adapted from drivers/media/dvb/dvb-core/dvbdev.c  */
  37
  38 static DEFINE_MUTEX(dvbdev_mutex);
  39
  40 int dvb_usercopy(struct file *file,
  41                      unsigned int cmd, unsigned long arg,
  42                      int (*func)(struct file *file,
  43                      unsigned int cmd, void *arg))
  44 {
  45         char    sbuf[128];
  46         void    *mbuf = NULL;
  47         void    *parg = NULL;
  48         int     err  = -1;
  49
  50         /*  Copy arguments into temp kernel buffer  */
  51         switch (_IOC_DIR(cmd)) {
  52         case _IOC_NONE:
  53                 /*
  54                  * For this command, the pointer is actually an integer
  55                  * argument.
  56                  */
  57                 parg = (void *) arg;
  58                 break;
  59         case _IOC_READ: /* some v4l ioctls are marked wrong ... */
  60         case _IOC_WRITE:
  61         case (_IOC_WRITE | _IOC_READ):
  62                 if (_IOC_SIZE(cmd) <= sizeof(sbuf)) {
  63                         parg = sbuf;
  64                 } else {
  65                         /* too big to allocate from stack */
  66                         mbuf = kmalloc(_IOC_SIZE(cmd),GFP_KERNEL);
  67                         if (NULL == mbuf)
  68                                 return -ENOMEM;
  69                         parg = mbuf;
  70                 }
  71
  72                 err = -EFAULT;
  73                 if (copy_from_user(parg, (void __user *)arg, _IOC_SIZE(cmd)))
  74                         goto out;
  75                 break;
  76         }
  77
  78         /* call driver */
  79         mutex_lock(&dvbdev_mutex);
  80         if ((err = func(file, cmd, parg)) == -ENOIOCTLCMD)
  81                 err = -EINVAL;
  82         mutex_unlock(&dvbdev_mutex);
  83
  84         if (err < 0)
  85                 goto out;
  86
  87         /*  Copy results into user buffer  */
  88         switch (_IOC_DIR(cmd))
  89         {
  90         case _IOC_READ:
  91         case (_IOC_WRITE | _IOC_READ):
  92                 if (copy_to_user((void __user *)arg, parg, _IOC_SIZE(cmd)))
  93                         err = -EFAULT;
  94                 break;
  95         }
  96
  97 out:
  98         kfree(mbuf);
  99         return err;
 100 }
 101
 102 long dvb_generic_ioctl(struct file *file,
 103                        unsigned int cmd, unsigned long arg)
 104 {
 105         struct dvb_device *dvbdev = file->private_data;
 106
 107         if (!dvbdev)
 108                 return -ENODEV;
 109
 110         if (!dvbdev->kernel_ioctl)
 111                 return -EINVAL;
 112
 113         return dvb_usercopy(file, cmd, arg, dvbdev->kernel_ioctl);
 114 }