lkml.org 
[lkml]   [2004]   [Oct]   [28]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
Date
From
SubjectRe: BUG REPORT: User/Kernel Pointer bug in sys_poll

> Nope. The only significant difference between copy_from_user() and
> __put_user() here is that copy_from_user() checks that the address is not
> in the 0xc0000000-0xffffffff range. __put_user() skips that check.

This is true for modern x86 architectures.

For some older 386's, where Write-Protect does not work okay, there is a
difference between put_user() and copy_from_user(). put_user() performs an
extra check called verify_write() in addition to checking the address
range. Hence, the following code may be unsafe when running on those
machines.
> So
>
> if (copy_from_user(kaddr, addr, n))
> fail();
> __put_user(42, addr);
>
> is safe. We know that the address is in the 0x00000000-0xbfffffff range by
> the time we call __put_user(). And if the page at *addr it not writeable
> the kernel will take a fault.

In older 386's, the kernel will NOT take a fault and write to the
write-protected region.

But then, maybe 386 is too old to worry about :-)

-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/

\
 
 \ /
  Last update: 2005-03-22 14:07    [W:0.761 / U:0.148 seconds]
©2003-2014 Jasper Spaans. Advertise on this site