[lkml]   [2007]   [Oct]   [6]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
Messages in this thread
    Patch in this message
    Subject[patch 9/9] compat_ioctl: fix compat_fd_ioctl pointer access
    As found by sparse, a user space pointer is assigned to a kernel
    data structure while calling other code with set_fs(KERNEL_DS),
    which could lead to leaking kernel data if that pointer is
    ever accessed.

    I could not find any place in the floppy drivers that actually
    uses that pointer, but assigning it to an empty string is
    a safer choice and gets rid of the sparse warning.

    Signed-off-by: Arnd Bergmann <>
    Index: linux-2.6/block/compat_ioctl.c
    --- linux-2.6.orig/block/compat_ioctl.c
    +++ linux-2.6/block/compat_ioctl.c
    @@ -349,7 +349,7 @@ static int compat_fd_ioctl(struct inode
    err |= __get_user(f->spec1, &uf->spec1);
    err |= __get_user(f->fmt_gap, &uf->fmt_gap);
    err |= __get_user(name, &uf->name);
    - f->name = compat_ptr(name);
    + f->name = "";
    if (err) {
    err = -EFAULT;
    goto out;

    To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
    the body of a message to
    More majordomo info at
    Please read the FAQ at

     \ /
      Last update: 2007-10-06 20:33    [W:0.024 / U:49.712 seconds]
    ©2003-2016 Jasper Spaans. hosted at Digital OceanAdvertise on this site