[linux-usb-devel] Re: Finding user/kernel pointer bugs [no html]

[linux-usb-devel] Re: Finding user/kernel pointer bugs [no html]

[Luca Risolia]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

>                    unsigned int cmd, void* arg)
>  {
>  	struct w9968cf_device* cam;
> +	void __user *user_arg = (void __user *)arg;

The right place to apply this patch is in video_usercopy().

When video_usercopy() is used in the ioctl() method, there is no need
to dereference the arg pointer in ioctl() itself, since one of the purposes
of video_usercopy() is to do this work for us.

Please have a look at definition of the function in videodev.c.

int
video_usercopy(struct inode *inode, struct file *file,
               unsigned int cmd, unsigned long arg,
               int (*func)(struct inode *inode, struct file *file,
                           unsigned int cmd, unsigned void *arg))

What you have patched in your patch is the function pointed
by "func" above, which should already receive the __user pointer to arg.

Luca
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.1 (GNU/Linux)

iD8DBQFAyTWLmdpdKvzmNaQRAhDuAJ0e8okB48LQUaHnxZsSS0ZFTmuxRQCgnYqZ
WECeSegLUG5WDyUArFcByKU=
=u+vB
-----END PGP SIGNATURE-----

Re: [linux-usb-devel] Re: Finding user/kernel pointer bugs [no html]

[viro]

On Fri, Jun 11, 2004 at 06:31:07AM +0200, Luca Risolia wrote:
> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA1
> 
> >                    unsigned int cmd, void* arg)
> >  {
> >  	struct w9968cf_device* cam;
> > +	void __user *user_arg = (void __user *)arg;
> 
> The right place to apply this patch is in video_usercopy().

The right thing to do is to kill video_usercopy() as ugly piece of crap.

Re: [linux-usb-devel] Re: Finding user/kernel pointer bugs [no html]

[Greg KH]

On Fri, Jun 11, 2004 at 06:31:07AM +0200, Luca Risolia wrote:
> >                    unsigned int cmd, void* arg)
> >  {
> >  	struct w9968cf_device* cam;
> > +	void __user *user_arg = (void __user *)arg;
> 
> The right place to apply this patch is in video_usercopy().

Um, the driver you just refered to does not use the video_usercopy()
function so your email doesn't make much sense in this context.

> Please have a look at definition of the function in videodev.c.

Please excuse me while I go get sick...

Anyway, that function needs to be properly marked up with __user if you
want it to live.

good luck,

greg k-h

Re: [linux-usb-devel] Re: Finding user/kernel pointer bugs [no html]

[Luca Risolia]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

On Fri, 11 Jun 2004 09:17:48 -0700
Greg KH <greg@kroah.com> wrote:

> On Fri, Jun 11, 2004 at 06:31:07AM +0200, Luca Risolia wrote:
> > >                    unsigned int cmd, void* arg)
> > >  {
> > >  	struct w9968cf_device* cam;
> > > +	void __user *user_arg = (void __user *)arg;
> > 
> > The right place to apply this patch is in video_usercopy().
> 
> Um, the driver you just refered to does not use the video_usercopy()
> function so your email doesn't make much sense in this context.

Oops, sorry. I forgot the w9968cf doesn't actually use video_usercopy().
However, apart from the "__user" context, there are several drivers
under drivers/usb/media/ that still use that usercopy() thing.

> 
> > Please have a look at definition of the function in videodev.c.
> 
> Please excuse me while I go get sick...
> 
> Anyway, that function needs to be properly marked up with __user if you
> want it to live.
> 
> good luck,
> 
> greg k-h
> 
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.1 (GNU/Linux)

iD8DBQFAyeHImdpdKvzmNaQRAgSbAJ9J+Zq4PsS59Z0muH1nJM036CCBzACglYQO
5/kAGoFHru+NpJ0/wNd0YT0=
=57yE
-----END PGP SIGNATURE-----