From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1751835AbdJDIWZ (ORCPT ); Wed, 4 Oct 2017 04:22:25 -0400 Received: from mail.linuxfoundation.org ([140.211.169.12]:57224 "EHLO mail.linuxfoundation.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1751354AbdJDIWX (ORCPT ); Wed, 4 Oct 2017 04:22:23 -0400 Date: Wed, 4 Oct 2017 10:22:31 +0200 From: Greg KH To: Meng Xu Cc: jslaby@suse.com, kilobyte@angband.pl, linux-kernel@vger.kernel.org, meng.xu@gatech.edu, sanidhya@gatech.edu, taesoo@gatech.edu Subject: Re: [PATCH] tty: vt: remove multi-fetch, derive font.height from font.data Message-ID: <20171004082231.GA13559@kroah.com> References: <1506272382-17815-1-git-send-email-mengxu.gatech@gmail.com> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <1506272382-17815-1-git-send-email-mengxu.gatech@gmail.com> User-Agent: Mutt/1.9.1 (2017-09-22) Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org On Sun, Sep 24, 2017 at 12:59:42PM -0400, Meng Xu wrote: > In con_font_set(), when we need to guess font height (for > compat reasons?), the current approach uses multiple userspace > fetches, i.e., get_user(tmp, &charmap[32*i+h-1]), to derive > the height. This has two drawbacks: > > 1. performance: accessing userspace memory is less efficient than > directly de-reference the byte > > 2. security: a more critical problem is that the height derived > might not match with the actual font.data. This is because a user > thread might race condition to change the memory of op->data after > the op->height guessing but before the second fetch: font.data = > memdup_user(op->data, size). Leaving font.height = 32 while the > actual height is 1 or vice-versa. > > This patch tries to resolve both issues by re-locating the height > guessing part after the font.data is fetched in. In this way, the > userspace data is fetched in one shot and we directly dereference > the font.data in kernel space to probe for the height. > > Signed-off-by: Meng Xu > --- > drivers/tty/vt/vt.c | 48 ++++++++++++++++++++++++++++-------------------- > 1 file changed, 28 insertions(+), 20 deletions(-) Please always run your patches through checkpatch.pl so that you don't get a grumpy maintainer telling you to use checkpatch.pl :( Can you fix the obvious issues up and resend? thanks, greg k-h