lkml.org 
[lkml]   [2003]   [Mar]   [24]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    /
    Date
    From
    SubjectRe: [CHECKER] potential dereference of user pointer errors
    On Sun, 23 Mar 2003, Junfeng Yang wrote:

    > ---------------------------------------------------------
    > [BUG] snd_sb_csp_ioctl -> snd_sb_csp_riff_load ->snd_sb_csp_load.
    > /home/junfeng/linux-2.5.63/sound/isa/sb/sb16_csp.c:647:snd_sb_csp_load:
    > ERROR:tainted:647:647:deferencing buf++ tainted by
    > [dist=-1][(null)][TRANS: buf++, $stop$->tainted,
    > /home/junfeng/linux-2.5.63/sound/isa/sb/sb16_csp.c, snd_sb_csp_load, 647]
    >
    > }
    > kfree (_kbuf);
    > } else {
    > /* load from kernel space */
    > while (size--) {
    >
    > Error --->
    > if (!snd_sbdsp_command(p->chip, *buf++))
    > goto __fail;
    > }
    > }

    This code is ok. The source (user or kernel space) is checked a few lines
    before.

    > ---------------------------------------------------------
    > [BUG] copy function can take tainted inputs
    > /home/junfeng/linux-2.5.63/sound/pci/es1938.c:833:snd_es1938_capture_copy:
    > ERROR:tainted:835:833: passing dst into deref cal __constant_memcpy
    > [dist=1][thru snd_pcm_ops_t:copy
    > /home/junfeng/linux-2.5.63/sound/pci/cmipci.c:snd_cmipci_ac3_copy:parm3
    > copy_from_user:parm1][START: dst, unknown->tainted,
    > /home/junfeng/linux-2.5.63/sound/pci/es1938.c, snd_es1938_capture_copy,
    > 833]
    >
    > es1938_t *chip = snd_pcm_substream_chip(substream);
    > pos <<= chip->dma1_shift;
    > count <<= chip->dma1_shift;
    > snd_assert(pos + count <= chip->dma1_size, return -EINVAL);
    > if (pos + count < chip->dma1_size)
    > Error --->
    > memcpy(dst, runtime->dma_area + pos + 1, count);
    > else {
    > Start --->
    > memcpy(dst, runtime->dma_area + pos + 1, count - 1);
    > ((unsigned char *)dst)[count - 1] = runtime->dma_area[0];
    > }
    > return 0;

    Fixed. Replaced memcpy with copy_to_user(). Thanks.

    Jaroslav

    -----
    Jaroslav Kysela <perex@suse.cz>
    Linux Kernel Sound Maintainer
    ALSA Project, SuSE Labs

    -
    To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
    the body of a message to majordomo@vger.kernel.org
    More majordomo info at http://vger.kernel.org/majordomo-info.html
    Please read the FAQ at http://www.tux.org/lkml/

    \
     
     \ /
      Last update: 2005-03-22 13:34    [W:2.240 / U:0.444 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site