Re: Finding user/kernel pointer bugs [no html]

[David Brownell <david-b@pacbell.net>]

Greg KH wrote:
> On Thu, Jun 10, 2004 at 05:49:03AM +0100, viro@parcelfarce.linux.theplanet.co.uk wrote:

>>272 is interesting - it's in
>>static void async_completed(struct urb *urb, struct pt_regs *regs)
>>{
>>        ...
>>}
>>and it brings two questions:
>>	a) shouldn't ->si_addr be a __user pointer (in all contexts I see
>>it is one)
>>	b) WTF is usb doing messing with it directly?
>>Note that drivers/usb/core/{devio,inode}.c are the only users of that animal
>>outside of arch/*.  Looks fishy...
> 
> 
> I really don't know.  I think David added that code.  David, any ideas?

Not me.  I think that's the original code from Thomas Sailer;
I've never touched the usbfs AIO core.  (Maybe you're thinking
of some oops-on-disconnect fixups I did, forcing completions
on all the usbfs-internal async requests.  That's now done in
usbcore.)

Speaking of AIO, I've been thinking I should submit that
gadgetfs AIO support for 2.6.7+ kernels.  It's amazing what
can be done with that small an amount of code ... and IMO
that's the right model to use for stuff like this.  I'll
re-test first, on the off chance it broke recently.

- Dave