On Wednesday, May 22, 2013 02:59:11 PM Jiri Slaby wrote:
> From: Vasiliy Kulikov <[email protected]>
>
> User space pointer may not be dereferenced. Use get_user()/put_user()
> instead and check their return codes.
>
> Signed-off-by: Vasiliy Kulikov <[email protected]>
> Signed-off-by: Thomas Renninger <[email protected]>
> Signed-off-by: Jiri Slaby <[email protected]>
> Cc: Len Brown <[email protected]>
> Cc: "Rafael J. Wysocki" <[email protected]>
> Cc: [email protected]
Interesting. It looks like it actually didn't reach linux-acpi.
Anyway, I'm going to queue it up for v3.11.
Thanks,
Rafael
> ---
> drivers/acpi/ec_sys.c | 18 ++++++++++++++----
> 1 file changed, 14 insertions(+), 4 deletions(-)
>
> diff --git a/drivers/acpi/ec_sys.c b/drivers/acpi/ec_sys.c
> index 7586544..4e7b798 100644
> --- a/drivers/acpi/ec_sys.c
> +++ b/drivers/acpi/ec_sys.c
> @@ -12,6 +12,7 @@
> #include <linux/acpi.h>
> #include <linux/debugfs.h>
> #include <linux/module.h>
> +#include <linux/uaccess.h>
> #include "internal.h"
>
> MODULE_AUTHOR("Thomas Renninger <[email protected]>");
> @@ -34,7 +35,6 @@ static ssize_t acpi_ec_read_io(struct file *f, char __user
> *buf,
> * struct acpi_ec *ec = ((struct seq_file *)f->private_data)->private;
> */
> unsigned int size = EC_SPACE_SIZE;
> - u8 *data = (u8 *) buf;
> loff_t init_off = *off;
> int err = 0;
>
> @@ -47,9 +47,15 @@ static ssize_t acpi_ec_read_io(struct file *f, char __user
> *buf,
> size = count;
>
> while (size) {
> - err = ec_read(*off, &data[*off - init_off]);
> + u8 byte_read;
> + err = ec_read(*off, &byte_read);
> if (err)
> return err;
> + if (put_user(byte_read, buf + *off - init_off)) {
> + if (*off - init_off)
> + return *off - init_off; /* partial read */
> + return -EFAULT;
> + }
> *off += 1;
> size--;
> }
> @@ -65,7 +71,6 @@ static ssize_t acpi_ec_write_io(struct file *f, const char
> __user *buf,
>
> unsigned int size = count;
> loff_t init_off = *off;
> - u8 *data = (u8 *) buf;
> int err = 0;
>
> if (*off >= EC_SPACE_SIZE)
> @@ -76,7 +81,12 @@ static ssize_t acpi_ec_write_io(struct file *f, const char
> __user *buf,
> }
>
> while (size) {
> - u8 byte_write = data[*off - init_off];
> + u8 byte_write;
> + if (get_user(byte_write, buf + *off - init_off)) {
> + if (*off - init_off)
> + return *off - init_off; /* partial write */
> + return -EFAULT;
> + }
> err = ec_write(*off, byte_write);
> if (err)
> return err;
>
--
I speak only for myself.
Rafael J. Wysocki, Intel Open Source Technology Center.
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to [email protected]
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/
