Re: [CHECKER] 9 potential copy_*_user bugs in 2.4.1

2001-03-20 Thread Rusty Russell
In message <[EMAIL PROTECTED]> you write: > Hi, > > I wrote an extension to gcc that does global analysis to determine > which pointers in 2.4.1 are ever treated as user space pointers (i.e, > passed to copy_*_user, verify_area, etc) and then makes sure they are > always treated that way. Hi Daw

Re: [CHECKER] 9 potential copy_*_user bugs in 2.4.1

2001-03-16 Thread Russell King
On Fri, Mar 16, 2001 at 10:06:48AM +, David Woodhouse wrote: > Nice work - thanks. One request though, to you and anyone else doing such > cleanups - please could you list the affected files separately near the > beginning of your mail, so that people can tell at a glance whether there's > any

Re: [CHECKER] 9 potential copy_*_user bugs in 2.4.1

2001-03-16 Thread Jamie Lokier
Alexander Viro wrote: > * verify_area() cleans the value, but you'll be better off > considering these as dangerous - it only checks that range is OK and if > pointer arithmetics moves you out of that range or you access piece longer > than range in question... Note that verify_area's argum

Re: [CHECKER] 9 potential copy_*_user bugs in 2.4.1

2001-03-16 Thread David Woodhouse
[EMAIL PROTECTED] said: > I wrote an extension to gcc that does global analysis to determine > which pointers in 2.4.1 are ever treated as user space pointers (i.e, > passed to copy_*_user, verify_area, etc) and then makes sure they are > always treated that way. Nice work - thanks. One request

Re: [CHECKER] 9 potential copy_*_user bugs in 2.4.1

2001-03-15 Thread Dawson Engler
> Looks like you've missed at least one place. Have you marked pointer > arguments of syscalls as tainted? Path in question looks so: In the exokernel param checker we do, but not for the one in linux --- most of the pointers seemed to be devices, so I never added it. Afer your for bug example,

Re: [CHECKER] 9 potential copy_*_user bugs in 2.4.1

2001-03-15 Thread David S. Miller
Dawson Engler writes: > - > [UNKNOWN] I'm not sure about this: "csum_partial_*" calls the generic > cksum routine which does guard against user pointers --- > is this redundant paranoia in this case? > > /u2/engler/mc/

Re: [CHECKER] 9 potential copy_*_user bugs in 2.4.1

2001-03-15 Thread Greg KH
On Thu, Mar 15, 2001 at 06:24:51PM -0800, Dawson Engler wrote: > Hi, > > I wrote an extension to gcc that does global analysis to determine > which pointers in 2.4.1 are ever treated as user space pointers (i.e, > passed to copy_*_user, verify_area, etc) and then makes sure they are > always trea

Re: [CHECKER] 9 potential copy_*_user bugs in 2.4.1

2001-03-15 Thread Alexander Viro
On Thu, 15 Mar 2001, Dawson Engler wrote: > Hi, > > I wrote an extension to gcc that does global analysis to determine > which pointers in 2.4.1 are ever treated as user space pointers (i.e, > passed to copy_*_user, verify_area, etc) and then makes sure they are > always treated that way. > >

[CHECKER] 9 potential copy_*_user bugs in 2.4.1

2001-03-15 Thread Dawson Engler
Hi, I wrote an extension to gcc that does global analysis to determine which pointers in 2.4.1 are ever treated as user space pointers (i.e, passed to copy_*_user, verify_area, etc) and then makes sure they are always treated that way. It found what looks to be 9 errors, and 3 cases I'm not sur