public inbox for linux-kernel@vger.kernel.org
 help / color / mirror / Atom feed
* Industrial device driver uio/uio_*
@ 2006-09-11 17:22 Alan Cox
  2006-09-11 19:23 ` Jan Engelhardt
  2006-10-04 18:59 ` Alan Cox
  0 siblings, 2 replies; 11+ messages in thread
From: Alan Cox @ 2006-09-11 17:22 UTC (permalink / raw)
  To: akpm, linux-kernel

This passed me by while I was away so I only saw it to review in mm6. It
looks like it has a few problems...


uio_lseek locking ?

uio_read uses f->f_pos which it should never do
ditto uio_write ...

The uio_read/write functions can race seek or other read/write

The uio_read/write functions do signed maths checks on unsigned types
(size_t) so the count check fails.

Partially completed I/O returns -EFAULT, should return the length
transferred OK

The *ppos adjustment means you can get f_pos to interestingly unsafe
values. Generally speaking do

	loff_t pos = *ppos;

	do stuff with pos

	pos += movement;
	*ppos = pos;


If idev->virtaddr is an mmio object you can't use copy_from/to_user on
it

uio_event is based on sizeof(int) so makes 32bit compat code insanely
hard

event_poll is wrong - poll methods shouldn't error just return "ready"

idev->event_listener appears to have no locking versus the irq handler
and the like.

Anyone appears to be able to select any process as the task to signal or
out of range or negative values

I've not begun to look at uio_base.c in detail but it seems a lot of
code to do very little. That said I can see the problem it is trying to
solve, I'm just not sure it helps as is.

Alan


^ permalink raw reply	[flat|nested] 11+ messages in thread

end of thread, other threads:[~2006-10-06  0:38 UTC | newest]

Thread overview: 11+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2006-09-11 17:22 Industrial device driver uio/uio_* Alan Cox
2006-09-11 19:23 ` Jan Engelhardt
2006-09-12  1:43   ` Greg KH
2006-09-17  9:41     ` Jan Engelhardt
2006-10-04 18:59 ` Alan Cox
2006-10-04 19:18   ` Andrew Morton
2006-10-04 19:32     ` Thomas Gleixner
2006-10-04 21:37       ` Alan Cox
2006-10-05  8:12       ` Paul Mundt
2006-10-05 12:12         ` Alan Cox
2006-10-06  0:37         ` Greg KH

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox