Messages in this thread | | | Date | Wed, 30 Apr 2003 21:55:13 -0700 (PDT) | From | Junfeng Yang <> | Subject | [CHECKER] 2 potential passing kernel-pointer into copy_*_user errors |
| |
Hi,
Below are 2 more warnings where kernel pointer is passed into *_do_ioctl (these functions are passed into video_usercopy). Please note that our checker flags the dereferences as errors, where the actually errors should be the copy_*_user calls.
Thanks a lot!
-Junfeng
--------------------------------------------------------- [BUG] pass kernel pointer into copy_*_user. bug is in VIDIOCGTUNER. Should not call copy_to_user on arg since arg is already in kernel space.
/home/junfeng/linux-2.5.63/drivers/media/radio/radio-cadet.c:397:cadet_do_ioctl: ERROR:TAINTED:397:397: dereferencing tainted ptr 'v' [Callstack: ]
{ case VIDIOCGCAP: { struct video_capability *v = arg; memset(v,0,sizeof(*v));
Error ---> v->type=VID_TYPE_TUNER; v->channels=2; v->audios=1; strcpy(v->name, "ADS Cadet"); --------------------------------------------------------- [BUG] pass kernel pointer into copy_*_user. should not call copy_to_user on case VIDIOCGCHAN
/home/junfeng/linux-2.5.63/drivers/media/video/bw-qcam.c:763:qcam_do_ioctl: ERROR:TAINTED:763:763: dereferencing tainted ptr 'p' [Callstack: ]
return 0; } case VIDIOCGPICT: { struct video_picture *p = arg;
Error ---> p->colour=0x8000; p->hue=0x8000; p->brightness=qcam->brightness<<8; p->contrast=qcam->contrast<<8;
- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/
| |