Re: TAKE 956783 - xfs_dm_getall_dmattr() doesn't check if the user buffer is at valid address

[Vlad Apostolov <vapo@sgi.com>]

Christoph Hellwig wrote:
> On Tue, Nov 21, 2006 at 05:21:12PM +1100, Vlad Apostolov wrote:
>   
>> No EFAULT error when dm_getall_dmattr() called with an invalid user 
>> buffer address.
>>     
>
> This fix is broken.  access_ok is not enough to verify the buffer,
> it just does very few static check (basically the address space limit)
>
> You need to use copy_{from,to}_user to access user pointers.  I had
> an untested patch to fix this at my good old SGI time, but Dean wanted
> to review and test it a lot more.  I'll try to dig up that patch if you care.
>   
The fix is actually fine as it gives an early indication (even not complete)
that the user pointer is bad. There is another problem you are pointing at and 
it is the userspace pointer dereference later on without using copy_to_user(). 
If you have any patch fixing this problem it would be great.

Thanks and regards,
Vlad