David> W00t :-) All applied, thanks Roland.
David> I'll run it through some build tests then toss it upstream.
Very cool, thanks a lot. Let me know if you see any build failures --
I test on about 6 or 7 different archs/configs but the bug gods always
seem to hide problems from me.
Speaking of build failures, one of my test builds is cross-compiling
for sparc64 with gcc 3.4.2, which adds __attribute__((warn_unused_result))
to copy_to_user() et al. The -Werror in the arch/sparc64 means the
build fails with
linux-2.6.10/arch/sparc64/kernel/sys_sparc32.c:1686: warning: ignoring
return value of `copy_to_user', declared with attribute warn_unused_result
Of course binfmt_elf.c and compat_ioctl.c still have issues but those
probably get more visibility...
Thanks,
Roland
Check copy_to_user() return value in sys_sparc32.c and sys_sunos32.c.
Signed-off-by: Roland Dreier <roland@xxxxxxxxxxx>
Index: linux-2.6.10/arch/sparc64/kernel/sys_sparc32.c
===================================================================
--- linux-2.6.10.orig/arch/sparc64/kernel/sys_sparc32.c 2004-12-24
13:35:00.000000000 -0800
+++ linux-2.6.10/arch/sparc64/kernel/sys_sparc32.c 2004-12-28
11:46:00.190457463 -0800
@@ -1683,7 +1683,8 @@
put_user(oldlen, (u32 __user *)(unsigned long)
tmp.oldlenp))
error = -EFAULT;
}
- copy_to_user(args->__unused, tmp.__unused,
sizeof(tmp.__unused));
+ if (copy_to_user(args->__unused, tmp.__unused,
sizeof(tmp.__unused)))
+ error = -EFAULT;
}
return error;
#endif
Index: linux-2.6.10/arch/sparc64/kernel/sys_sunos32.c
===================================================================
--- linux-2.6.10.orig/arch/sparc64/kernel/sys_sunos32.c 2004-12-24
13:35:00.000000000 -0800
+++ linux-2.6.10/arch/sparc64/kernel/sys_sunos32.c 2004-12-28
11:47:03.954923634 -0800
@@ -291,7 +291,8 @@
put_user(ino, &dirent->d_ino);
put_user(namlen, &dirent->d_namlen);
put_user(reclen, &dirent->d_reclen);
- copy_to_user(dirent->d_name, name, namlen);
+ if (copy_to_user(dirent->d_name, name, namlen))
+ return -EFAULT;
put_user(0, dirent->d_name + namlen);
dirent = (void __user *) dirent + reclen;
buf->curr = dirent;
@@ -371,7 +372,8 @@
put_user(ino, &dirent->d_ino);
put_user(namlen, &dirent->d_namlen);
put_user(reclen, &dirent->d_reclen);
- copy_to_user(dirent->d_name, name, namlen);
+ if (copy_to_user(dirent->d_name, name, namlen))
+ return -EFAULT;
put_user(0, dirent->d_name + namlen);
dirent = (void __user *) dirent + reclen;
buf->curr = dirent;
|