Dubios pointer casting with put_user()

From: Richard Sailer <richard_siegfried@systemli.org>
To: kernelnewbies <Kernelnewbies@kernelnewbies.org>
Subject: Dubios pointer casting with put_user()
Date: Fri, 17 Jul 2020 02:13:34 +0200	[thread overview]
Message-ID: <d8a96eaf-3cbf-a088-5dd5-ad8b64ec9749@systemli.org> (raw)

[-- Attachment #1.1.1: Type: text/plain, Size: 803 bytes --]

Hi,

In the following example from net/dccp/proto.c the pointer given
put_user() is casted to (int __user *) although the value to copy is a
unsigned long. Is this (correctness and security wise) sane? Because as
I understand it put_user() determines the amount it copies from the
pointer type.

```
		unsigned long amount = 0;

		skb = skb_peek(&sk->sk_receive_queue);
		if (skb != NULL) {
			amount = skb->len;
		}
		rc = put_user(amount, (int __user *)arg);
```

Also skb->len is an unsigned int realisticly in most cases < 9000 (and
in all cases I can imagine < int_max (with 16 bit)).

I would like to declare amount as int outside of the switch case
statement (because I  need it in another case statement as signed int)
would it be safe to do so?

Thanks,
-- Richard

[-- Attachment #1.2: OpenPGP digital signature --]
[-- Type: application/pgp-signature, Size: 488 bytes --]

[-- Attachment #2: Type: text/plain, Size: 170 bytes --]

_______________________________________________
Kernelnewbies mailing list
Kernelnewbies@kernelnewbies.org
https://lists.kernelnewbies.org/mailman/listinfo/kernelnewbies