Messages in this thread | | | Date | Tue, 05 Jan 2010 12:47:42 -0800 (PST) | Subject | Re: [PATCH] sparc: copy_from_user() should not return -EFAULT | From | David Miller <> |
| |
From: Andi Kleen <andi@firstfloor.org> Date: Tue, 05 Jan 2010 18:27:18 +0100
> Heiko Carstens <heiko.carstens@de.ibm.com> writes: > >> Subject: [PATCH] sparc: copy_from_user() should not return -EFAULT >> >> From: Heiko Carstens <heiko.carstens@de.ibm.com> >> >> Callers of copy_from_user() expect it to return the number of bytes >> it could not copy. In no case it is supposed to return -EFAULT. >> >> In case of a detected buffer overflow just return the requested >> length. In addition one could think of a memset that would clear >> the size of the target object. > > Ouch! I would expect this is likely exploitable, e.g. in mount
You can rest easy as the problem only exists in 2.6.33-rcX, it got introduced when I ported over the compile time length validation bits from x86.
| |