From 6a3981af3fd97fec57f2c5eeca213cbf5216a3c0 Mon Sep 17 00:00:00 2001 From: Kees Cook Date: Tue, 16 Aug 2022 12:14:54 -0700 Subject: LoadPin: Return EFAULT on copy_from_user() failures The copy_from_user() function returns the number of bytes remaining to be copied on a failure. Such failures should return -EFAULT to high levels. Reported-by: kernel test robot Reported-by: Dan Carpenter Fixes: 3f805f8cc23b ("LoadPin: Enable loading from trusted dm-verity devices") Cc: Matthias Kaehlcke Cc: James Morris Cc: "Serge E. Hallyn" Cc: linux-security-module@vger.kernel.org Signed-off-by: Kees Cook --- security/loadpin/loadpin.c | 6 ++---- 1 file changed, 2 insertions(+), 4 deletions(-) (limited to 'security/loadpin') diff --git a/security/loadpin/loadpin.c b/security/loadpin/loadpin.c index 6ab5f2bbf41f..44521582dcba 100644 --- a/security/loadpin/loadpin.c +++ b/security/loadpin/loadpin.c @@ -356,13 +356,11 @@ static long dm_verity_ioctl(struct file *filp, unsigned int cmd, unsigned long a { void __user *uarg = (void __user *)arg; unsigned int fd; - int rc; switch (cmd) { case LOADPIN_IOC_SET_TRUSTED_VERITY_DIGESTS: - rc = copy_from_user(&fd, uarg, sizeof(fd)); - if (rc) - return rc; + if (copy_from_user(&fd, uarg, sizeof(fd))) + return -EFAULT; return read_trusted_verity_root_digests(fd); -- cgit v1.2.3