From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1754677AbbLJJw2 (ORCPT ); Thu, 10 Dec 2015 04:52:28 -0500 Received: from wimdewith.com ([188.226.197.86]:46222 "EHLO wimdewith.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1754502AbbLJJwY (ORCPT ); Thu, 10 Dec 2015 04:52:24 -0500 X-Greylist: delayed 595 seconds by postgrey-1.27 at vger.kernel.org; Thu, 10 Dec 2015 04:52:24 EST Subject: Re: [PATCH] staging: gdm72xx: add userspace data struct To: Dan Carpenter References: <1449738672-24429-1-git-send-email-nauxuron@wimdewith.com> <20151210093720.GD5284@mwanda> Cc: gregkh@linuxfoundation.org, devel@driverdev.osuosl.org, linux-kernel@vger.kernel.org From: Wim de With Message-ID: <566948F6.80904@wimdewith.com> Date: Thu, 10 Dec 2015 10:42:14 +0100 User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:38.0) Gecko/20100101 Thunderbird/38.4.0 MIME-Version: 1.0 In-Reply-To: <20151210093720.GD5284@mwanda> Content-Type: text/plain; charset=windows-1252 Content-Transfer-Encoding: 7bit Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org On 10-12-2015 10:37, Dan Carpenter wrote: > On Thu, Dec 10, 2015 at 10:11:12AM +0100, Wim de With wrote: >> @@ -482,8 +483,16 @@ static int gdm_wimax_ioctl(struct net_device *dev, struct ifreq *ifr, int cmd) >> /* NOTE: gdm_update_fsm should be called >> * before gdm_wimax_ioctl_set_data is called. >> */ >> - gdm_update_fsm(dev, >> - req->data.buf); >> + fsm_buf = kmalloc(sizeof(fsm_s), GFP_KERNEL); >> + if (!fsm_buf) >> + return -ENOMEM; >> + if (copy_from_user(fsm_buf, req->data.buf, >> + sizeof(fsm_s))) { >> + kfree(fsm_buf); >> + return -EFAULT; >> + } >> + gdm_update_fsm(dev, fsm_buf); >> + kfree(fsm_buf); > > > No. This change is a bug. > > regards, > dan carpenter > But what if I just keep it as: gdm_update_fsm(dev, req->data.buf) Then it would just trust a __user pointer right? Wim