lkml.org 
[lkml]   [2001]   [May]   [29]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
From
Date
SubjectRe: [CHECKER] 4 security holes in 2.4.4-ac8

Dawson Engler writes:
> -------------------------------------------------------------------------------
> [BUG] raddr seems to be a user pointer, but is written at the end of
> the system call.
>
> ipc/shm.c: ERROR: system call 'sys_shmat' derefs non-tainted param= 3
>
> asmlinkage long sys_shmat (int shmid, char *shmaddr, int shmflg, ulong *raddr)
> {
> struct shmid_kernel *shp;
>
>
> ...
> *raddr = (unsigned long) user_addr;
> err = 0;
> if (IS_ERR(user_addr))
> err = PTR_ERR(user_addr);
> return err;

Believe it or not, this one is OK :-)

All callers pass in a pointer to a local stack kernel variable
in raddr.

Later,
David S. Miller
davem@redhat.com

-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/

\
 
 \ /
  Last update: 2005-03-22 12:54    [W:0.098 / U:0.240 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site