Messages in this thread | | | Date | Wed, 22 Apr 2015 07:33:07 +0100 | From | "Jan Beulich" <> | Subject | regression from your recent change to x86's copy_user_handle_tail() |
| |
Linus,
while the description of commit cae2a173fe certainly makes sense, the change itself ignores the __probe_kernel_write() code path, for which the destination address is expected to be in kernel space but accesses may still fault. I.e. the use of plain memset() causes __probe_kernel_write() to oops rather than return an error. Shouldn't the "(unsigned long)to >= TASK_SIZE_MAX" be relaxed to take the effect of set_fs() into account?
Thanks, Jan
| |