[lkml]   [2004]   [Oct]   [28]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
Messages in this thread
    SubjectRe: BUG REPORT: User/Kernel Pointer bug in sys_poll

    > Nope. The only significant difference between copy_from_user() and
    > __put_user() here is that copy_from_user() checks that the address is not
    > in the 0xc0000000-0xffffffff range. __put_user() skips that check.

    This is true for modern x86 architectures.

    For some older 386's, where Write-Protect does not work okay, there is a
    difference between put_user() and copy_from_user(). put_user() performs an
    extra check called verify_write() in addition to checking the address
    range. Hence, the following code may be unsafe when running on those

    > So
    > if (copy_from_user(kaddr, addr, n))
    > fail();
    > __put_user(42, addr);
    > is safe. We know that the address is in the 0x00000000-0xbfffffff range by
    > the time we call __put_user(). And if the page at *addr it not writeable
    > the kernel will take a fault.

    In older 386's, the kernel will NOT take a fault and write to the
    write-protected region.

    But then, maybe 386 is too old to worry about :-)

    To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
    the body of a message to
    More majordomo info at
    Please read the FAQ at

     \ /
      Last update: 2005-03-22 14:07    [W:0.018 / U:51.400 seconds]
    ©2003-2016 Jasper Spaans. hosted at Digital OceanAdvertise on this site