lkml.org 
[lkml]   [2023]   [May]   [31]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
From
SubjectRE: [PATCH RFC v2] tpm: tpm_vtpm_proxy: do not reference kernel memory as user memory
Date
From: Stefan Berger
> Sent: 30 May 2023 18:46
>
> On 5/29/23 22:01, Jarkko Sakkinen wrote:
> > From: Jarkko Sakkinen <jarkko.sakkinen@tuni.fi>
> >
>
> > - rc = copy_to_user(buf, proxy_dev->buffer, len);
> > + if (buf)
> > + rc = copy_to_user(buf, proxy_dev->buffer, len);
> > +
>
> Looking through other drivers it seems buf is always expected to be a valid non-NULL pointer on
> file_operations.read().

If the user passes NULL the copy_to/from_user() fails and
-EFAULT is returned.

Adding the NULL check makes the request silently succeed.
I doubt that is anywhere near right when you ignore copy_from_user().

I'm not sure what the rational/subject is about either.
copy_to/from_user() calls access_ok() and will fail on
a kernel address.

David

-
Registered Address Lakeside, Bramley Road, Mount Farm, Milton Keynes, MK1 1PT, UK
Registration No: 1397386 (Wales)
\
 
 \ /
  Last update: 2023-05-31 09:49    [W:0.062 / U:2.000 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site