lkml.org 
[lkml]   [2000]   [Jan]   [23]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
From
SubjectSuspicious code in i2c-dev.c
Date
Hi,

Looking through i2c-dev.c, I noticed the following code, which appears
to be wrong:

/* copy user space data to kernel space. */
tmp = kmalloc(count,GFP_KERNEL);
if (tmp==NULL)
return -ENOMEM;
#ifdef DEBUG
printk("i2c-dev,o: i2c-%d reading %d bytes.\n",MINOR(inode->i_rdev),count);
#endif

ret = i2c_master_recv(client,tmp,count);
copy_to_user(buf,tmp,count);
kfree(tmp);
return ret;

for the following reasons:

1. If i2c_master_recv does not write to `tmp' but returns an error,
copy_to_user will copy uninitialised kernel memory to the user,
possibly from another user process - security concern.

2. copy_to_user may fault, and if this is the case, the user will
never know (the user will not see the EFAULT error code returned).

There are more instances of point 2, including some with copy_from_user.
_____
|_____| ------------------------------------------------- ---+---+-
| | Russell King rmk@arm.linux.org.uk --- ---
| | | | http://www.arm.linux.org.uk/~rmk/aboutme.html / / |
| +-+-+ --- -+-
/ | THE developer of ARM Linux |+| /|\
/ | | | --- |
+-+-+ ------------------------------------------------- /\\\ |
-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.rutgers.edu
Please read the FAQ at http://www.tux.org/lkml/

\
 
 \ /
  Last update: 2005-03-22 13:56    [W:0.258 / U:0.136 seconds]
©2003-2014 Jasper Spaans. Advertise on this site