Messages in this thread Patch in this message | | | Subject | PATCH: 2.6.7-rc3 drivers/scsi/megaraid.c: user/kernel pointer bugs | From | "Robert T. Johnson" <> | Date | 09 Jun 2004 16:10:32 -0700 |
| |
Since arg is a user pointer, so are uioc_mimd and uiocp, and hence umc is a user pointer. Thus reading umc->xferaddr requires dereferencing a user pointer, which isn't safe. Let me know if you have any questions or I've made an error.
Best, Rob
--- linux-2.6.7-rc3-full/drivers/scsi/megaraid.c.orig Wed Jun 9 12:43:49 2004 +++ linux-2.6.7-rc3-full/drivers/scsi/megaraid.c Wed Jun 9 12:43:10 2004 @@ -3815,7 +3815,8 @@ mega_n_to_m(void *arg, megacmd_t *mc) umc = MBOX_P(uiocp); - upthru = (mega_passthru *)umc->xferaddr; + if (get_user(upthru, (mega_passthru **)&umc->xferaddr)) + return (-EFAULT); if( put_user(mc->status, (u8 *)&upthru->scsistatus) ) return (-EFAULT); @@ -3831,7 +3832,8 @@ mega_n_to_m(void *arg, megacmd_t *mc) umc = (megacmd_t *)uioc_mimd->mbox; - upthru = (mega_passthru *)umc->xferaddr; + if (get_user(upthru, (mega_passthru **)&umc->xferaddr)) + return (-EFAULT); if( put_user(mc->status, (u8 *)&upthru->scsistatus) ) return (-EFAULT);
- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/
| |