Oh whoops, I sent this to the wrong person. Javier, you introduced a
bug with 5702222c9a7a ('Input: joydev - use memdup_user() to duplicate
memory from user-space')
regards,
dan carpenter
On Tue, Oct 06, 2015 at 10:57:26PM +0200, Stephen Kitt wrote:
> Hello Dan,
>
> On Tue, 6 Oct 2015 21:51:55 +0300, Dan Carpenter <dan.carpen...@oracle.com>
> wrote:
> > The patch 999b874f4aa3: "Input: joydev - validate axis/button maps
> > before clobbering current ones" from Aug 25, 2009, leads to the
> > following static checker warning:
> >
> > drivers/input/joydev.c:466 joydev_handle_JSIOCSAXMAP()
> > error: 'abspam' dereferencing possible ERR_PTR()
> >
> > drivers/input/joydev.c
> > 437 static int joydev_handle_JSIOCSAXMAP(struct joydev *joydev,
> > 438 void __user *argp, size_t len)
> > 439 {
> > 440 __u8 *abspam;
> > 441 int i;
> > 442 int retval = 0;
> > 443
> > 444 len = min(len, sizeof(joydev->abspam));
> > 445
> > 446 /* Validate the map. */
> > 447 abspam = memdup_user(argp, len);
> > 448 if (IS_ERR(abspam)) {
> > 449 retval = PTR_ERR(abspam);
> > 450 goto out;
> >
> > out labels are error prone. It's safer to return directly.
> >
> > https://plus.google.com/106378716002406849458/posts/dnanfhQ4mHQ
> >
> > joydev_handle_JSIOCSBTNMAP() has the same issue.
>
> Perhaps I'm missing something here, but that's not the code I wrote, nor is
> it the code that's currently in the kernel. What I have in my copy of the
> kernel tree is
>
> /* Validate the map. */
> abspam = kmalloc(len, GFP_KERNEL);
> if (!abspam)
> return -ENOMEM;
>
> which does as you recommend. If you look up the commit you're referring to
> you'll see that's also the code as I wrote it back in 2009; I'm not sure
> where your IS_ERR() and PTR_ERR() stuff is coming from.
>
> Regards,
>
> Stephen
--
To unsubscribe from this list: send the line "unsubscribe linux-input" in
the body of a message to majord...@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
