Messages in this thread | | | Subject | Re: [PATCH] sparc: copy_from_user() should not return -EFAULT | From | Andi Kleen <> | Date | Tue, 05 Jan 2010 18:27:18 +0100 |
| |
Heiko Carstens <heiko.carstens@de.ibm.com> writes:
> Subject: [PATCH] sparc: copy_from_user() should not return -EFAULT > > From: Heiko Carstens <heiko.carstens@de.ibm.com> > > Callers of copy_from_user() expect it to return the number of bytes > it could not copy. In no case it is supposed to return -EFAULT. > > In case of a detected buffer overflow just return the requested > length. In addition one could think of a memset that would clear > the size of the target object.
Ouch! I would expect this is likely exploitable, e.g. in mount
-Andi
-- ak@linux.intel.com -- Speaking for myself only.
| |