* [PATCH][MIPS] add return value check to user_termio_to_kernel_termios()
@ 2009-01-25 13:45 Yoichi Yuasa
2009-01-28 12:40 ` Ralf Baechle
0 siblings, 1 reply; 4+ messages in thread
From: Yoichi Yuasa @ 2009-01-25 13:45 UTC (permalink / raw)
To: Ralf Baechle; +Cc: yoichi_yuasa, linux-mips
Signed-off-by: Yoichi Yuasa <yoichi_yuasa@tripeaks.co.jp>
diff -pruN -X /home/yuasa/Memo/dontdiff linux-orig/arch/mips/include/asm/termios.h linux/arch/mips/include/asm/termios.h
--- linux-orig/arch/mips/include/asm/termios.h 2008-10-19 22:33:14.114377349 +0900
+++ linux/arch/mips/include/asm/termios.h 2008-10-19 22:41:25.322369698 +0900
@@ -97,14 +97,14 @@ struct termio {
#define user_termio_to_kernel_termios(termios, termio) \
({ \
unsigned short tmp; \
- get_user(tmp, &(termio)->c_iflag); \
- (termios)->c_iflag = (0xffff0000 & ((termios)->c_iflag)) | tmp; \
- get_user(tmp, &(termio)->c_oflag); \
- (termios)->c_oflag = (0xffff0000 & ((termios)->c_oflag)) | tmp; \
- get_user(tmp, &(termio)->c_cflag); \
- (termios)->c_cflag = (0xffff0000 & ((termios)->c_cflag)) | tmp; \
- get_user(tmp, &(termio)->c_lflag); \
- (termios)->c_lflag = (0xffff0000 & ((termios)->c_lflag)) | tmp; \
+ if (!get_user(tmp, &(termio)->c_iflag)) \
+ (termios)->c_iflag = (0xffff0000 & ((termios)->c_iflag)) | tmp; \
+ if (!get_user(tmp, &(termio)->c_oflag)) \
+ (termios)->c_oflag = (0xffff0000 & ((termios)->c_oflag)) | tmp; \
+ if (!get_user(tmp, &(termio)->c_cflag)) \
+ (termios)->c_cflag = (0xffff0000 & ((termios)->c_cflag)) | tmp; \
+ if (!get_user(tmp, &(termio)->c_lflag)) \
+ (termios)->c_lflag = (0xffff0000 & ((termios)->c_lflag)) | tmp; \
get_user((termios)->c_line, &(termio)->c_line); \
copy_from_user((termios)->c_cc, (termio)->c_cc, NCC); \
})
^ permalink raw reply [flat|nested] 4+ messages in thread* Re: [PATCH][MIPS] add return value check to user_termio_to_kernel_termios() 2009-01-25 13:45 [PATCH][MIPS] add return value check to user_termio_to_kernel_termios() Yoichi Yuasa @ 2009-01-28 12:40 ` Ralf Baechle 2009-01-28 13:40 ` Ralf Baechle 0 siblings, 1 reply; 4+ messages in thread From: Ralf Baechle @ 2009-01-28 12:40 UTC (permalink / raw) To: Yoichi Yuasa; +Cc: linux-mips On Sun, Jan 25, 2009 at 10:45:57PM +0900, Yoichi Yuasa wrote: > diff -pruN -X /home/yuasa/Memo/dontdiff linux-orig/arch/mips/include/asm/termios.h linux/arch/mips/include/asm/termios.h > --- linux-orig/arch/mips/include/asm/termios.h 2008-10-19 22:33:14.114377349 +0900 > +++ linux/arch/mips/include/asm/termios.h 2008-10-19 22:41:25.322369698 +0900 > @@ -97,14 +97,14 @@ struct termio { > #define user_termio_to_kernel_termios(termios, termio) \ > ({ \ > unsigned short tmp; \ > - get_user(tmp, &(termio)->c_iflag); \ > - (termios)->c_iflag = (0xffff0000 & ((termios)->c_iflag)) | tmp; \ > - get_user(tmp, &(termio)->c_oflag); \ > - (termios)->c_oflag = (0xffff0000 & ((termios)->c_oflag)) | tmp; \ > - get_user(tmp, &(termio)->c_cflag); \ > - (termios)->c_cflag = (0xffff0000 & ((termios)->c_cflag)) | tmp; \ > - get_user(tmp, &(termio)->c_lflag); \ > - (termios)->c_lflag = (0xffff0000 & ((termios)->c_lflag)) | tmp; \ > + if (!get_user(tmp, &(termio)->c_iflag)) \ > + (termios)->c_iflag = (0xffff0000 & ((termios)->c_iflag)) | tmp; \ > + if (!get_user(tmp, &(termio)->c_oflag)) \ > + (termios)->c_oflag = (0xffff0000 & ((termios)->c_oflag)) | tmp; \ > + if (!get_user(tmp, &(termio)->c_cflag)) \ > + (termios)->c_cflag = (0xffff0000 & ((termios)->c_cflag)) | tmp; \ > + if (!get_user(tmp, &(termio)->c_lflag)) \ > + (termios)->c_lflag = (0xffff0000 & ((termios)->c_lflag)) | tmp; \ > get_user((termios)->c_line, &(termio)->c_line); \ > copy_from_user((termios)->c_cc, (termio)->c_cc, NCC); \ Duh... That sort of trivial thing is not fatal but just shouldn't happen. And other architectures have the same bug even. Your patch leaves the last get_user and the copy_from_user return values unchecked. I'll sort that out. Thanks for reporting and patch! Ralf ^ permalink raw reply [flat|nested] 4+ messages in thread
* Re: [PATCH][MIPS] add return value check to user_termio_to_kernel_termios() 2009-01-28 12:40 ` Ralf Baechle @ 2009-01-28 13:40 ` Ralf Baechle 2009-01-29 12:00 ` Yoichi Yuasa 0 siblings, 1 reply; 4+ messages in thread From: Ralf Baechle @ 2009-01-28 13:40 UTC (permalink / raw) To: Yoichi Yuasa; +Cc: linux-mips On Wed, Jan 28, 2009 at 12:40:47PM +0000, Ralf Baechle wrote: > Duh... That sort of trivial thing is not fatal but just shouldn't > happen. And other architectures have the same bug even. Your patch > leaves the last get_user and the copy_from_user return values unchecked. > I'll sort that out. How about this patch which also gets rid of the rest of the macro soup by replacing them with inline functions. How about this? Ralf Signed-off-by: Ralf Baechle <ralf@linux-mips.org> commit 848091da998d2f0d5fe70c6bcd34a0cdf5c7f2b2 Author: Yoichi Yuasa <yoichi_yuasa@tripeaks.co.jp> Date: Sun Jan 25 22:45:57 2009 +0900 MIPS: Add return value checks to user_termio_to_kernel_termios() Signed-off-by: Yoichi Yuasa <yoichi_yuasa@tripeaks.co.jp> Signed-off-by: Ralf Baechle <ralf@linux-mips.org> diff --git a/arch/mips/include/asm/termios.h b/arch/mips/include/asm/termios.h index a275661..8f77f77 100644 --- a/arch/mips/include/asm/termios.h +++ b/arch/mips/include/asm/termios.h @@ -9,6 +9,7 @@ #ifndef _ASM_TERMIOS_H #define _ASM_TERMIOS_H +#include <linux/errno.h> #include <asm/termbits.h> #include <asm/ioctls.h> @@ -94,38 +95,81 @@ struct termio { /* * Translate a "termio" structure into a "termios". Ugh. */ -#define user_termio_to_kernel_termios(termios, termio) \ -({ \ - unsigned short tmp; \ - get_user(tmp, &(termio)->c_iflag); \ - (termios)->c_iflag = (0xffff0000 & ((termios)->c_iflag)) | tmp; \ - get_user(tmp, &(termio)->c_oflag); \ - (termios)->c_oflag = (0xffff0000 & ((termios)->c_oflag)) | tmp; \ - get_user(tmp, &(termio)->c_cflag); \ - (termios)->c_cflag = (0xffff0000 & ((termios)->c_cflag)) | tmp; \ - get_user(tmp, &(termio)->c_lflag); \ - (termios)->c_lflag = (0xffff0000 & ((termios)->c_lflag)) | tmp; \ - get_user((termios)->c_line, &(termio)->c_line); \ - copy_from_user((termios)->c_cc, (termio)->c_cc, NCC); \ -}) +static inline int user_termio_to_kernel_termios(struct ktermios *termios, + struct termio __user *termio) +{ + unsigned short iflag, oflag, cflag, lflag; + unsigned int err; + + if (!access_ok(VERIFY_READ, termio, sizeof(struct termio))) + return -EFAULT; + + err = __get_user(iflag, &termio->c_iflag); + termios->c_iflag = (termios->c_iflag & 0xffff0000) | iflag; + err |=__get_user(oflag, &termio->c_oflag); + termios->c_oflag = (termios->c_oflag & 0xffff0000) | oflag; + err |=__get_user(cflag, &termio->c_cflag); + termios->c_cflag = (termios->c_cflag & 0xffff0000) | cflag; + err |=__get_user(lflag, &termio->c_lflag); + termios->c_lflag = (termios->c_lflag & 0xffff0000) | lflag; + err |=__get_user(termios->c_line, &termio->c_line); + if (err) + return -EFAULT; + + if (__copy_from_user(termios->c_cc, termio->c_cc, NCC)) + return -EFAULT; + + return 0; +} /* * Translate a "termios" structure into a "termio". Ugh. */ -#define kernel_termios_to_user_termio(termio, termios) \ -({ \ - put_user((termios)->c_iflag, &(termio)->c_iflag); \ - put_user((termios)->c_oflag, &(termio)->c_oflag); \ - put_user((termios)->c_cflag, &(termio)->c_cflag); \ - put_user((termios)->c_lflag, &(termio)->c_lflag); \ - put_user((termios)->c_line, &(termio)->c_line); \ - copy_to_user((termio)->c_cc, (termios)->c_cc, NCC); \ -}) - -#define user_termios_to_kernel_termios(k, u) copy_from_user(k, u, sizeof(struct termios2)) -#define kernel_termios_to_user_termios(u, k) copy_to_user(u, k, sizeof(struct termios2)) -#define user_termios_to_kernel_termios_1(k, u) copy_from_user(k, u, sizeof(struct termios)) -#define kernel_termios_to_user_termios_1(u, k) copy_to_user(u, k, sizeof(struct termios)) +static inline int kernel_termios_to_user_termio(struct termio __user *termio, + struct ktermios *termios) +{ + int err; + + if (!access_ok(VERIFY_WRITE, termio, sizeof(struct termio))) + return -EFAULT; + + err = __put_user(termios->c_iflag, &termio->c_iflag); + err |= __put_user(termios->c_oflag, &termio->c_oflag); + err |= __put_user(termios->c_cflag, &termio->c_cflag); + err |= __put_user(termios->c_lflag, &termio->c_lflag); + err |= __put_user(termios->c_line, &termio->c_line); + if (err) + return -EFAULT; + + if (__copy_to_user(termio->c_cc, termios->c_cc, NCC)) + return -EFAULT; + + return 0; +} + +static inline int user_termios_to_kernel_termios(struct ktermios __user *k, + struct termios2 *u) +{ + return copy_from_user(k, u, sizeof(struct termios2)) ? -EFAULT : 0; +} + +static inline int kernel_termios_to_user_termios(struct termios2 __user *u, + struct ktermios *k) +{ + return copy_to_user(u, k, sizeof(struct termios2)) ? -EFAULT : 0; +} + +static inline int user_termios_to_kernel_termios_1(struct ktermios *k, + struct termios __user *u) +{ + return copy_from_user(k, u, sizeof(struct termios)) ? -EFAULT : 0; +} + +static inline int kernel_termios_to_user_termios_1(struct termios __user *u, + struct ktermios *k) +{ + return copy_to_user(u, k, sizeof(struct termios)) ? -EFAULT : 0; +} #endif /* defined(__KERNEL__) */ ^ permalink raw reply related [flat|nested] 4+ messages in thread
* Re: [PATCH][MIPS] add return value check to user_termio_to_kernel_termios() 2009-01-28 13:40 ` Ralf Baechle @ 2009-01-29 12:00 ` Yoichi Yuasa 0 siblings, 0 replies; 4+ messages in thread From: Yoichi Yuasa @ 2009-01-29 12:00 UTC (permalink / raw) To: Ralf Baechle; +Cc: yoichi_yuasa, linux-mips Hi, On Wed, 28 Jan 2009 13:40:07 +0000 Ralf Baechle <ralf@linux-mips.org> wrote: > On Wed, Jan 28, 2009 at 12:40:47PM +0000, Ralf Baechle wrote: > > > Duh... That sort of trivial thing is not fatal but just shouldn't > > happen. And other architectures have the same bug even. Your patch > > leaves the last get_user and the copy_from_user return values unchecked. > > I'll sort that out. > > How about this patch which also gets rid of the rest of the macro soup > by replacing them with inline functions. > > How about this? It's good for me. Yoichi ^ permalink raw reply [flat|nested] 4+ messages in thread
end of thread, other threads:[~2009-01-29 12:01 UTC | newest] Thread overview: 4+ messages (download: mbox.gz follow: Atom feed -- links below jump to the message on this page -- 2009-01-25 13:45 [PATCH][MIPS] add return value check to user_termio_to_kernel_termios() Yoichi Yuasa 2009-01-28 12:40 ` Ralf Baechle 2009-01-28 13:40 ` Ralf Baechle 2009-01-29 12:00 ` Yoichi Yuasa
This is an external index of several public inboxes, see mirroring instructions on how to clone and mirror all data and code used by this external index.