lkml.org 
[lkml]   [2007]   [Oct]   [6]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    Date
    From
    Subject[patch 9/9] compat_ioctl: fix compat_fd_ioctl pointer access
    As found by sparse, a user space pointer is assigned to a kernel
    data structure while calling other code with set_fs(KERNEL_DS),
    which could lead to leaking kernel data if that pointer is
    ever accessed.

    I could not find any place in the floppy drivers that actually
    uses that pointer, but assigning it to an empty string is
    a safer choice and gets rid of the sparse warning.

    Signed-off-by: Arnd Bergmann <arnd@arndb.de>
    Index: linux-2.6/block/compat_ioctl.c
    ===================================================================
    --- linux-2.6.orig/block/compat_ioctl.c
    +++ linux-2.6/block/compat_ioctl.c
    @@ -349,7 +349,7 @@ static int compat_fd_ioctl(struct inode
    err |= __get_user(f->spec1, &uf->spec1);
    err |= __get_user(f->fmt_gap, &uf->fmt_gap);
    err |= __get_user(name, &uf->name);
    - f->name = compat_ptr(name);
    + f->name = "";
    if (err) {
    err = -EFAULT;
    goto out;
    --

    -
    To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
    the body of a message to majordomo@vger.kernel.org
    More majordomo info at http://vger.kernel.org/majordomo-info.html
    Please read the FAQ at http://www.tux.org/lkml/

    \
     
     \ /
      Last update: 2007-10-06 20:33    [W:0.018 / U:32.144 seconds]
    ©2003-2016 Jasper Spaans. hosted at Digital OceanAdvertise on this site