[lkml]   [2003]   [Mar]   [21]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
Messages in this thread
Patch in this message
SubjectRe: [CHECKER] potential dereference of user pointer errors
* Junfeng Yang ( wrote:
> [BUG] cmd is tainted. then they do copy_to_user (cmd->resbuf, ...) resbuf
> is declared as a pointer, not an array, so cmd->resbuf can point to
> anywhere.
> /home/junfeng/linux-2.5.63/drivers/message/i2o/i2o_config.c:440:ioctl_parms:
> ERROR:TAINTED deferencing "cmd" tainted by [dist=0][(null)]

I don't think this could be used to corrupt kernel data because the
copy_to_user will, of course, still verify the resbuf pointer, and the
original copy_from_user validated the cmd pointer. The possibility of
trashing the processes own memory space is there, but can be done anyway
on first pass of the cmd. However, this is inconsistent with the rest
of the file, so here is a patch to use kcmd.resbuf. I also added a NULL
check, as done in similar funcitons in this file. Alan, this look ok?

Linux Security Modules

===== drivers/message/i2o/i2o_config.c 1.14 vs edited =====
--- 1.14/drivers/message/i2o/i2o_config.c Wed Feb 19 12:18:31 2003
+++ edited/drivers/message/i2o/i2o_config.c Fri Mar 21 14:17:20 2003
@@ -394,6 +394,9 @@
if(get_user(reslen, kcmd.reslen))
return -EFAULT;

+ if(!kcmd.resbuf)
+ return -EFAULT;
c = i2o_find_controller(kcmd.iop);
return -ENXIO;
@@ -437,7 +440,7 @@
put_user(len, kcmd.reslen);
if(len > reslen)
ret = -ENOBUFS;
- else if(copy_to_user(cmd->resbuf, res, len))
+ else if(copy_to_user(kcmd->resbuf, res, len))
ret = -EFAULT;

To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to
More majordomo info at
Please read the FAQ at
 \ /
  Last update: 2005-03-22 13:34    [W:0.210 / U:0.804 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site