Messages in this thread | | | From | Tony Luck <> | Date | Fri, 20 Aug 2021 21:51:41 -0700 | Subject | Re: [PATCH v2 1/3] x86/mce: Avoid infinite loop for copy from user recovery |
| |
On Fri, Aug 20, 2021 at 1:25 PM Luck, Tony <tony.luck@intel.com> wrote: > Probably the same for the two different addresses case ... though I'm > not 100% confident about that. There could be some ioctl() that peeks > at two parts of a passed in structure, and the user might pass in a > structure that spans across a page boundary with both pages poisoned. > But that would only hit if the driver code ignored the failure of the > first get_user() and blindly tried the second. So I'd count that as a > critically bad driver bug.
Or maybe driver writers are just evil :-(
for (i = 0; i < len; i++) { tx_wait(10); get_user(dsp56k_host_interface.data.b[1], bin++); get_user(dsp56k_host_interface.data.b[2], bin++); get_user(dsp56k_host_interface.data.b[3], bin++); }
-Tony
| |