Christoph Hellwig wrote:
On Tue, Nov 21, 2006 at 05:21:12PM +1100, Vlad Apostolov wrote:
No EFAULT error when dm_getall_dmattr() called with an invalid user
buffer address.
This fix is broken. access_ok is not enough to verify the buffer,
it just does very few static check (basically the address space limit)
You need to use copy_{from,to}_user to access user pointers. I had
an untested patch to fix this at my good old SGI time, but Dean wanted
to review and test it a lot more. I'll try to dig up that patch if you care.
The fix is actually fine as it gives an early indication (even not complete)
that the user pointer is bad. There is another problem you are pointing at and
it is the userspace pointer dereference later on without using copy_to_user().
If you have any patch fixing this problem it would be great.
Thanks and regards,
Vlad
|