LKML Archive on lore.kernel.org
help / color / mirror / Atom feed
From: Jan Engelhardt <jengelh@linux01.gwdg.de>
To: Suhabe Bugrara <suhabe@stanford.edu>
Cc: linux-kernel@vger.kernel.org
Subject: Re: user pointer bugs
Date: Mon, 15 Jan 2007 17:56:47 +0100 (MET)	[thread overview]
Message-ID: <Pine.LNX.4.61.0701151746370.23841@yvahk01.tjqt.qr> (raw)
In-Reply-To: <5166c2f30701141558td770dfbt13fd5098f76bcde6@mail.gmail.com>


On Jan 14 2007 15:58, Suhabe Bugrara wrote:
>
> In linux-2.6.19.2, do the following lines have bugs in them? It looks
> like they dereference a user pointer without first being checked by
> the "access_ok" macro to ensure that they point into userspace.
>
> Suhabe
>
> ========================
> File: sound/isa/sscape.c
> Lines: 550, 665
> Description: The pointer "bb" is dereferenced in the expression
> "bb->code" without being checked first.
> Fix: Replace "bb->code" with "&bb->code"

Looking at 2.6.20-rc5 now...

550: ret = upload_dma_data(sscape, bb->code, sizeof(bb->code));
665: if ( !access_ok(VERIFY_READ, bb->code, sizeof(bb->code)) )

Here's a test:

$ cat x.c
/*1*/ struct foo {
/*2*/     char bar[256];
/*3*/ };
/*4*/ int main(void) {
/*5*/     struct foo tmp;
/*6*/     char *x = tmp.bar;
/*7*/     char *y = &tmp.bar;
/*8*/     return 0;
/*9*/ }

$ cc x.c -Wall
x.c:7: warning: initialization from incompatible pointer type

Hence, &bb->code would be wrong. Really. (Talk to ##c or comp.lang.c
perhaps on details.)

>
> ========================
> File: block/scsi_ioctl.c
> Lines: 406, 427, 430, 482, 486
> Description: The pointer "sic" is dereferenced in the expression
> "sic->data" without being checked first.
> Fix: Replace "sic->code" with "&sic->code"

Same. sic->code decays into a char* when used.
This gets boring, I won't look at the others.


	-`J'
-- 

      reply	other threads:[~2007-01-15 16:57 UTC|newest]

Thread overview: 2+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2007-01-14 23:58 Suhabe Bugrara
2007-01-15 16:56 ` Jan Engelhardt [this message]

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=Pine.LNX.4.61.0701151746370.23841@yvahk01.tjqt.qr \
    --to=jengelh@linux01.gwdg.de \
    --cc=linux-kernel@vger.kernel.org \
    --cc=suhabe@stanford.edu \
    --subject='Re: user pointer bugs' \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).