From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1751381AbeEMHG3 (ORCPT ); Sun, 13 May 2018 03:06:29 -0400 Received: from mx2.suse.de ([195.135.220.15]:40941 "EHLO mx2.suse.de" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1751264AbeEMHG2 (ORCPT ); Sun, 13 May 2018 03:06:28 -0400 Date: Sun, 13 May 2018 09:06:26 +0200 Message-ID: From: Takashi Iwai To: "Wenwen Wang" Cc: "moderated list:SOUND" , "Jaroslav Kysela" , "Kangjie Lu" , "open list" Subject: Re: [PATCH] ALSA: control: fix a redundant-copy issue In-Reply-To: <1525545485-12183-1-git-send-email-wang6495@umn.edu> References: <1525545485-12183-1-git-send-email-wang6495@umn.edu> User-Agent: Wanderlust/2.15.9 (Almost Unreal) SEMI/1.14.6 (Maruoka) FLIM/1.14.9 (=?UTF-8?B?R29qxY0=?=) APEL/10.8 Emacs/25.3 (x86_64-suse-linux-gnu) MULE/6.0 (HANACHIRUSATO) MIME-Version: 1.0 (generated by SEMI 1.14.6 - "Maruoka") Content-Type: text/plain; charset=US-ASCII Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org On Sat, 05 May 2018 20:38:03 +0200, Wenwen Wang wrote: > > In snd_ctl_elem_add_compat(), the fields of the struct 'data' need to be > copied from the corresponding fields of the struct 'data32' in userspace. > This is achieved by invoking copy_from_user() and get_user() functions. The > problem here is that the 'type' field is copied twice. One is by > copy_from_user() and one is by get_user(). Given that the 'type' field is > not used between the two copies, the second copy is *completely* redundant > and should be removed for better performance and cleanup. Also, these two > copies can cause inconsistent data: as the struct 'data32' resides in > userspace and a malicious userspace process can race to change the 'type' > field between the two copies to cause inconsistent data. Depending on how > the data is used in the future, such an inconsistency may cause potential > security risks. > > For above reasons, we should take out the second copy. > > Signed-off-by: Wenwen Wang Applied now, thanks. Takashi