[lkml]   [2003]   [Mar]   [24]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
Messages in this thread
SubjectRe: [CHECKER] potential dereference of user pointer errors

Junfeng Yang <> writes:

> We are the the Stanford Checker team that constantly send error
> reports to the linux kernel mailing list. Enclosed are 10
> dereference of user pointer warnings catched by our checker. We
> started by marking the second parameter of copy_from_user (to, from,
> len), the first parameter of copy_to_user (to, from, len), and all
> parameters of the sys_* functions as tainted, then propogated the
> tainted annotations along call chains. If two functions get assigned
> to the same structure field, we propogate the tainted annotations
> between them, too. An example of such propogation is the warning
> about drivers/media/video/cpia.c::cpia_write_proc and
> drivers/media/usb/media/vicam.c. The error message uses "thru
> struct_name:field_name" to represent such propogations.

Can't pointer-dereference errors be handled directly by any C
compiler. Is CHECKER necessary for this. Use an incomplete
struct pointer and the compiler will complain on all dereferences.

Something like

/* struct user_space should never be defined. */
typedef struct user_space user_space;

int copy_to_user (user_space *to, char *from, size_t len);
int copy_from_user (char *to, user_space *from, size_t len);
/* ... */

({ \
BUG_ON(get_fs() != get_gs()); \
(user_space *)p; \

- Hari
Raja R Harinath ------------------------------

To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to
More majordomo info at
Please read the FAQ at

 \ /
  Last update: 2005-03-22 13:34    [W:0.341 / U:1.444 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site