Messages in this thread | | | Date | Thu, 21 Aug 2003 14:50:44 -0700 (PDT) | From | Junfeng Yang <> | Subject | [CHECKER] 2 user-pointer bugs in 2.6.0-test3 |
| |
Hi,
Attached are 2 user-pointer bugs in 2.6.0-test3. As usual, confirmations or clarifications are welcomed.
-Junfeng
--------------------------------------------------------- [BUG] uioc_mimd = arg taints uioc_mimd, umc = uioc_mimd->mbox taints umc
/u1/junfeng/linux-2.6.0-test3/drivers/scsi/megaraid.c:4606:mega_n_to_m: ERROR:TAINTED:4606:4606: dereferencing tainted ptr 'umc' [from=' /u1/junfeng/linux-2.6.0-test3/include/asm/uaccess.h:copy_from_user:parm1 arg uioc_mimd'] [Callstack: ]
if( mc->cmd == MEGA_MBOXCMD_PASSTHRU ) {
umc = (megacmd_t *)uioc_mimd->mbox;
Error ---> upthru = (mega_passthru *)umc->xferaddr;
if( put_user(mc->status, (u8 *)&upthru->scsistatus) ) return (-EFAULT);
--------------------------------------------------------- [BUG] optlen is dereferenced in function sctp_getsockopt_peer_addr_params
/u1/junfeng/linux-2.6.0-test3/net/sctp/socket.c:3065:sctp_getsockopt: ERROR:TAINTED:3065:3065: passing tainted ptr 'optlen' into 'sctp_getsockopt_peer_addr_params' [to='/u1/junfeng/linux-2.6.0-test3/net/sctp/socket.c:sctp_getsockopt_peer_addr_params:3'] [from=' /u1/junfeng/linux-2.6.0-test3/net/ipv4/ipmr.c:sctp_getsockopt:parm4'] [Callstack: /u1/junfeng/linux-2.6.0-test3/net/ipv4/tcp.c:2450:sctp_getsockopt((tainted, 4)(untainted, 0))]
break; case SCTP_SOCKOPT_PEELOFF: retval = sctp_getsockopt_peeloff(sk, len, optval, optlen); break; case SCTP_GET_PEER_ADDR_PARAMS:
Error ---> retval = sctp_getsockopt_peer_addr_params(sk, len, optval, optlen); break; case SCTP_INITMSG:
- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/
| |