Messages in this thread | | | From | Arnd Bergmann <> | Subject | Re: strict copy_from_user checks issues? | Date | Tue, 5 Jan 2010 13:47:20 +0100 |
| |
On Tuesday 05 January 2010, Heiko Carstens wrote: > On Mon, Jan 04, 2010 at 05:43:08PM -0800, Arjan van de Ven wrote: > > On Mon, 4 Jan 2010 16:43:45 +0100 > > Heiko Carstens <heiko.carstens@de.ibm.com> wrote: > > > x86 and sparc return -EFAULT in copy_from_user instead of the number > > > of not copied bytes as it should in case of a detected buffer > > > overflow. That might have unwanted side effects. I would guess that > > > is a bug. > > > > killing the bad guy in case of a real buffer overflow is appropriate.. > > this should never trigger for legitimate users. > > The point I tried to make is that no caller of copy_from_user can assume > that it would ever return -EFAULT. And if any caller does so it is broken. > But then again it probably doesn't matter in this case as long as something > != 0 is returned.
To quote simple_read_from_buffer():
size_t ret; ... ret = copy_to_user(to, from + pos, count); if (ret == count) return -EFAULT; count -= ret; *ppos = pos + count; return count;
If copy_from_user() returns a negative value, bad things happen to f_pos and to the value returned from the syscall. Many read() file_operations do this similarly, and I wouldn't be surprised if this could be turned into a security exploit for one of them (not simple_read_from_buffer probably).
Arnd
| |