![]() | |||||||||||||
Messages in this thread |
Paul Mackerras <paulus@samba.org> wrote: > > Some time ago (in the 2.1 series IIRC) we added code to copy_from_user > to zero the remainder of the destination buffer if we faulted on the > source. The motive was to eliminate some potential security holes > that could arise if callers didn't check the return value from > copy_from_user and continued on to pass the contents of the > destination buffer back to userspace in one way or another. > > However, I notice that copy_from_user on i386 in 2.5 doesn't clear the > destination if the access_ok() check fails, This was not deliberate - the memset simply got lost. It is simple enough to fix. Do we remember the details of the security hole? > or if the size is 1, 2 or 4. This one is OK - __get_user_asm() does the zeroing in the fixup code. - To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/ | ||||||||||||
| Last update: 2005-03-22 12:36 [W:0.238 / U:0.160 seconds] ©2003-2008 Jasper Spaans | |||||||||||||