Re: [PATCH -mm] swsusp: userland interface (rev 2)

[Benjamin LaHaise <bcrl@kvack.org>]

On Wed, Jan 25, 2006 at 12:35:38AM +0100, Rafael J. Wysocki wrote:
> > > +		if (!access_ok(VERIFY_WRITE, (unsigned long __user *)arg, _IOC_SIZE(cmd))) {
> > > +			error = -EINVAL;
> > > +			break;
> > > +		}
> > 
> > Why do we need an access_ok() here?
> 
> Because we use __put_user() down the road?
> 
> The problem is if the address is wrong we should not try to call
> alloc_swap_page() at all.  If we did, we wouldn't be able to return the result
> and we would leak a swap page.

Then access_ok() is not the droid you are looking for... since it won't 
catch several cases (out of memory being the most obvious).  Doing an 
early put_user() wouldn't hurt and reduces the chance of later failure 
even further.  __put_user() should never be used outside of a select few 
performance critical code paths.

		-ben
-- 
"Ladies and gentlemen, I'm sorry to interrupt, but the police are here 
and they've asked us to stop the party."  Don't Email: <dont@kvack.org>.