From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
To: Michael Gehring <mg@ebfe.org>
Cc: linux-kernel@vger.kernel.org
Subject: Re: [PATCH] tty/vt: set_get_cmap() check user buffer
Date: Mon, 19 Mar 2012 16:48:39 -0700 [thread overview]
Message-ID: <20120319234839.GA26931@kroah.com> (raw)
In-Reply-To: <1332200041-31052-1-git-send-email-mg@ebfe.org>
On Tue, Mar 20, 2012 at 12:34:01AM +0100, Michael Gehring wrote:
> set_get_cmap() ignores the result of {get,put}_user(), causing ioctl(vt,
> {G,P}IO_CMAP, 0xdeadbeef) to silently fail.
Why not just check each return value, failing only if/when a specific
write fails?
>
> Another side effect of this: calling the PIO_CMAP ioctl with an invalid
> buffer will zero the default colormap and the palette for all vts (all
> colors set to black).
>
> Use access_ok() and return -EFAULT when appropriate.
>
> Signed-off-by: Michael Gehring <mg@ebfe.org>
> ---
> drivers/tty/vt/vt.c | 15 +++++++++------
> 1 file changed, 9 insertions(+), 6 deletions(-)
>
> diff --git a/drivers/tty/vt/vt.c b/drivers/tty/vt/vt.c
> index e716839..176b2a1 100644
> --- a/drivers/tty/vt/vt.c
> +++ b/drivers/tty/vt/vt.c
> @@ -3897,15 +3897,18 @@ static int set_get_cmap(unsigned char __user *arg, int set)
>
> WARN_CONSOLE_UNLOCKED();
>
> + if (!access_ok(set ? VERIFY_READ : VERIFY_WRITE, arg, 3 * 16))
> + return -EFAULT;
> +
> for (i = 0; i < 16; i++)
> if (set) {
> - get_user(default_red[i], arg++);
> - get_user(default_grn[i], arg++);
> - get_user(default_blu[i], arg++);
> + __get_user(default_red[i], arg++);
> + __get_user(default_grn[i], arg++);
> + __get_user(default_blu[i], arg++);
> } else {
> - put_user(default_red[i], arg++);
> - put_user(default_grn[i], arg++);
> - put_user(default_blu[i], arg++);
> + __put_user(default_red[i], arg++);
> + __put_user(default_grn[i], arg++);
> + __put_user(default_blu[i], arg++);
What's to keep this userspace buffer from becoming invalid after the
check? For some reason I thought we couldn't check beforehand like
this, but I can't recall why at this specific moment.
And ugh, why do we have a function that does two things, like this? The
only thing we are "saving" is a single for loop by doing things this
way, splitting it out into a set/get function, would make more sense in
the end.
thanks,
greg k-h
next prev parent reply other threads:[~2012-03-19 23:48 UTC|newest]
Thread overview: 6+ messages / expand[flat|nested] mbox.gz Atom feed top
2012-03-19 23:34 [PATCH] tty/vt: set_get_cmap() check user buffer Michael Gehring
2012-03-19 23:48 ` Greg Kroah-Hartman [this message]
2012-03-20 1:07 ` Michael Gehring
2012-03-20 8:38 ` Jiri Slaby
2012-03-20 23:00 ` Alan Cox
2012-03-21 0:26 ` [PATCH] tty/vt: handle bad user buffer in {G,P}IO_CMAP ioctl Michael Gehring
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20120319234839.GA26931@kroah.com \
--to=gregkh@linuxfoundation.org \
--cc=linux-kernel@vger.kernel.org \
--cc=mg@ebfe.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.