lkml.org 
[lkml]   [2014]   [Jul]   [30]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
Date
From
SubjectRe: [RFC PATCH 5/5] gfs2: Add xreaddir file operation and supporting functions
On Tue, 29 Jul 2014 18:25:57 -0400 (EDT)
Abhijith Das <adas@redhat.com> wrote:

> > > + if ((xc->xc_xattr_mask & XSTAT_XATTR_ALL) &&
> > > + lxd->xd_blob.xb_xattr_count) {
> >
> > How can that be right? lxd is __user, it doesn't seem right to be
> > dereferencing it directly...?
>
> Wouldn't the call to access_ok() at the start of the syscall take care of this? All the
> __user pointers point to areas within the user supplied buffer buf and overflow past the
> end of the buffer for the last lxd is checked for.

No, dereferencing user-space pointers in the kernel is never OK. What
if user space remapped that page after the access_ok() call? You need
to use copy_*_user() to get at user-space structures from the kernel.

jon


\
 
 \ /
  Last update: 2014-07-30 20:01    [W:0.040 / U:1.456 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site