* [PATCH 1/9] iwlegacy: Silence DEBUG_STRICT_USER_COPY_CHECKS=y warning
2011-05-12 23:50 [PATCH 0/9] strict user copy checks on x86_64 Stephen Boyd
@ 2011-05-12 23:50 ` Stephen Boyd
2011-05-13 0:01 ` wwguy
2011-05-13 9:08 ` Stanislaw Gruszka
2011-05-12 23:50 ` [PATCH 2/9] iwlwifi: " Stephen Boyd
` (2 subsequent siblings)
3 siblings, 2 replies; 10+ messages in thread
From: Stephen Boyd @ 2011-05-12 23:50 UTC (permalink / raw)
To: John W. Linville; +Cc: linux-kernel, linux-wireless, netdev, Johannes Berg
Enabling DEBUG_STRICT_USER_COPY_CHECKS causes the following
warning:
In file included from arch/x86/include/asm/uaccess.h:573,
from include/net/checksum.h:25,
from include/linux/skbuff.h:28,
from drivers/net/wireless/iwlegacy/iwl-4965-rs.c:28:
In function 'copy_from_user',
inlined from 'iwl4965_rs_sta_dbgfs_scale_table_write' at
drivers/net/wireless/iwlegacy/iwl-4965-rs.c:2616:
arch/x86/include/asm/uaccess_64.h:65:
warning: call to 'copy_from_user_overflow' declared with
attribute warning: copy_from_user() buffer size is not provably
correct
presumably due to buf_size being signed causing GCC to fail to
see that buf_size can't become negative.
Cc: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Stephen Boyd <sboyd@codeaurora.org>
---
drivers/net/wireless/iwlegacy/iwl-4965-rs.c | 2 +-
1 files changed, 1 insertions(+), 1 deletions(-)
diff --git a/drivers/net/wireless/iwlegacy/iwl-4965-rs.c b/drivers/net/wireless/iwlegacy/iwl-4965-rs.c
index 31ac672..cc4751c 100644
--- a/drivers/net/wireless/iwlegacy/iwl-4965-rs.c
+++ b/drivers/net/wireless/iwlegacy/iwl-4965-rs.c
@@ -2604,7 +2604,7 @@ static ssize_t iwl4965_rs_sta_dbgfs_scale_table_write(struct file *file,
struct iwl_lq_sta *lq_sta = file->private_data;
struct iwl_priv *priv;
char buf[64];
- int buf_size;
+ size_t buf_size;
u32 parsed_rate;
struct iwl_station_priv *sta_priv =
container_of(lq_sta, struct iwl_station_priv, lq_sta);
--
Sent by an employee of the Qualcomm Innovation Center, Inc.
The Qualcomm Innovation Center, Inc. is a member of the Code Aurora Forum.
^ permalink raw reply related [flat|nested] 10+ messages in thread* Re: [PATCH 1/9] iwlegacy: Silence DEBUG_STRICT_USER_COPY_CHECKS=y warning
2011-05-12 23:50 ` [PATCH 1/9] iwlegacy: Silence DEBUG_STRICT_USER_COPY_CHECKS=y warning Stephen Boyd
@ 2011-05-13 0:01 ` wwguy
2011-05-13 9:08 ` Stanislaw Gruszka
1 sibling, 0 replies; 10+ messages in thread
From: wwguy @ 2011-05-13 0:01 UTC (permalink / raw)
To: Stephen Boyd, Stanislaw Gruszka
Cc: John W. Linville, linux-kernel@vger.kernel.org,
linux-wireless@vger.kernel.org, netdev@vger.kernel.org,
Berg, Johannes
On Thu, 2011-05-12 at 16:50 -0700, Stephen Boyd wrote:
> Enabling DEBUG_STRICT_USER_COPY_CHECKS causes the following
> warning:
>
> In file included from arch/x86/include/asm/uaccess.h:573,
> from include/net/checksum.h:25,
> from include/linux/skbuff.h:28,
> from drivers/net/wireless/iwlegacy/iwl-4965-rs.c:28:
> In function 'copy_from_user',
> inlined from 'iwl4965_rs_sta_dbgfs_scale_table_write' at
> drivers/net/wireless/iwlegacy/iwl-4965-rs.c:2616:
> arch/x86/include/asm/uaccess_64.h:65:
> warning: call to 'copy_from_user_overflow' declared with
> attribute warning: copy_from_user() buffer size is not provably
> correct
>
> presumably due to buf_size being signed causing GCC to fail to
> see that buf_size can't become negative.
>
> Cc: Johannes Berg <johannes.berg@intel.com>
> Signed-off-by: Stephen Boyd <sboyd@codeaurora.org>
> ---
> drivers/net/wireless/iwlegacy/iwl-4965-rs.c | 2 +-
> 1 files changed, 1 insertions(+), 1 deletions(-)
>
Stanislaw Gruszka <sgruszka@redhat.com> is the maintainer for iwlegacy
Thanks
Wey
^ permalink raw reply [flat|nested] 10+ messages in thread
* Re: [PATCH 1/9] iwlegacy: Silence DEBUG_STRICT_USER_COPY_CHECKS=y warning
2011-05-12 23:50 ` [PATCH 1/9] iwlegacy: Silence DEBUG_STRICT_USER_COPY_CHECKS=y warning Stephen Boyd
2011-05-13 0:01 ` wwguy
@ 2011-05-13 9:08 ` Stanislaw Gruszka
1 sibling, 0 replies; 10+ messages in thread
From: Stanislaw Gruszka @ 2011-05-13 9:08 UTC (permalink / raw)
To: Stephen Boyd
Cc: John W. Linville, linux-kernel, linux-wireless, netdev,
Johannes Berg
On Thu, May 12, 2011 at 04:50:04PM -0700, Stephen Boyd wrote:
> Enabling DEBUG_STRICT_USER_COPY_CHECKS causes the following
> warning:
>
> In file included from arch/x86/include/asm/uaccess.h:573,
> from include/net/checksum.h:25,
> from include/linux/skbuff.h:28,
> from drivers/net/wireless/iwlegacy/iwl-4965-rs.c:28:
> In function 'copy_from_user',
> inlined from 'iwl4965_rs_sta_dbgfs_scale_table_write' at
> drivers/net/wireless/iwlegacy/iwl-4965-rs.c:2616:
> arch/x86/include/asm/uaccess_64.h:65:
> warning: call to 'copy_from_user_overflow' declared with
> attribute warning: copy_from_user() buffer size is not provably
> correct
>
> presumably due to buf_size being signed causing GCC to fail to
> see that buf_size can't become negative.
>
> Cc: Johannes Berg <johannes.berg@intel.com>
> Signed-off-by: Stephen Boyd <sboyd@codeaurora.org>
> ---
> drivers/net/wireless/iwlegacy/iwl-4965-rs.c | 2 +-
> 1 files changed, 1 insertions(+), 1 deletions(-)
>
> diff --git a/drivers/net/wireless/iwlegacy/iwl-4965-rs.c b/drivers/net/wireless/iwlegacy/iwl-4965-rs.c
> index 31ac672..cc4751c 100644
> --- a/drivers/net/wireless/iwlegacy/iwl-4965-rs.c
> +++ b/drivers/net/wireless/iwlegacy/iwl-4965-rs.c
> @@ -2604,7 +2604,7 @@ static ssize_t iwl4965_rs_sta_dbgfs_scale_table_write(struct file *file,
> struct iwl_lq_sta *lq_sta = file->private_data;
> struct iwl_priv *priv;
> char buf[64];
> - int buf_size;
> + size_t buf_size;
ACK, but we have more of that, perhaps you would like to fix them all.
If you don't want to, I'll do it. Note this can be easily done by:
sed -i 's/int buf_size;/size_t buf_size;/g' drivers/net/wireless/iwlegacy/*.[ch]
Stanislaw
^ permalink raw reply [flat|nested] 10+ messages in thread
* [PATCH 2/9] iwlwifi: Silence DEBUG_STRICT_USER_COPY_CHECKS=y warning
2011-05-12 23:50 [PATCH 0/9] strict user copy checks on x86_64 Stephen Boyd
2011-05-12 23:50 ` [PATCH 1/9] iwlegacy: Silence DEBUG_STRICT_USER_COPY_CHECKS=y warning Stephen Boyd
@ 2011-05-12 23:50 ` Stephen Boyd
2011-05-13 0:02 ` wwguy
2011-05-12 23:50 ` [PATCH 6/9] Bluetooth: " Stephen Boyd
2011-05-24 21:29 ` [PATCH 0/9] strict user copy checks on x86_64 Stephen Boyd
3 siblings, 1 reply; 10+ messages in thread
From: Stephen Boyd @ 2011-05-12 23:50 UTC (permalink / raw)
To: John W. Linville
Cc: linux-kernel, Intel Linux Wireless, linux-wireless, netdev,
Wey-Yi Guy
Enabling DEBUG_STRICT_USER_COPY_CHECKS causes the following
warning:
In file included from arch/x86/include/asm/uaccess.h:573,
from include/net/checksum.h:25,
from include/linux/skbuff.h:28,
from drivers/net/wireless/iwlwifi/iwl-agn-rs.c:28:
In function 'copy_from_user',
inlined from 'rs_sta_dbgfs_scale_table_write' at
drivers/net/wireless/iwlwifi/iwl-agn-rs.c:3099:
arch/x86/include/asm/uaccess_64.h:65:
warning: call to 'copy_from_user_overflow' declared with
attribute warning: copy_from_user() buffer size is not provably
correct
presumably due to buf_size being signed causing GCC to fail to
see that buf_size can't become negative.
Cc: Wey-Yi Guy <wey-yi.w.guy@intel.com>
Signed-off-by: Stephen Boyd <sboyd@codeaurora.org>
---
drivers/net/wireless/iwlwifi/iwl-agn-rs.c | 2 +-
1 files changed, 1 insertions(+), 1 deletions(-)
diff --git a/drivers/net/wireless/iwlwifi/iwl-agn-rs.c b/drivers/net/wireless/iwlwifi/iwl-agn-rs.c
index d03b473..abcc9f2 100644
--- a/drivers/net/wireless/iwlwifi/iwl-agn-rs.c
+++ b/drivers/net/wireless/iwlwifi/iwl-agn-rs.c
@@ -3087,7 +3087,7 @@ static ssize_t rs_sta_dbgfs_scale_table_write(struct file *file,
struct iwl_lq_sta *lq_sta = file->private_data;
struct iwl_priv *priv;
char buf[64];
- int buf_size;
+ size_t buf_size;
u32 parsed_rate;
struct iwl_station_priv *sta_priv =
container_of(lq_sta, struct iwl_station_priv, lq_sta);
--
Sent by an employee of the Qualcomm Innovation Center, Inc.
The Qualcomm Innovation Center, Inc. is a member of the Code Aurora Forum.
^ permalink raw reply related [flat|nested] 10+ messages in thread* Re: [PATCH 2/9] iwlwifi: Silence DEBUG_STRICT_USER_COPY_CHECKS=y warning
2011-05-12 23:50 ` [PATCH 2/9] iwlwifi: " Stephen Boyd
@ 2011-05-13 0:02 ` wwguy
0 siblings, 0 replies; 10+ messages in thread
From: wwguy @ 2011-05-13 0:02 UTC (permalink / raw)
To: Stephen Boyd
Cc: John W. Linville, linux-kernel@vger.kernel.org,
Intel Linux Wireless, linux-wireless@vger.kernel.org,
netdev@vger.kernel.org
On Thu, 2011-05-12 at 16:50 -0700, Stephen Boyd wrote:
> Enabling DEBUG_STRICT_USER_COPY_CHECKS causes the following
> warning:
>
> In file included from arch/x86/include/asm/uaccess.h:573,
> from include/net/checksum.h:25,
> from include/linux/skbuff.h:28,
> from drivers/net/wireless/iwlwifi/iwl-agn-rs.c:28:
> In function 'copy_from_user',
> inlined from 'rs_sta_dbgfs_scale_table_write' at
> drivers/net/wireless/iwlwifi/iwl-agn-rs.c:3099:
> arch/x86/include/asm/uaccess_64.h:65:
> warning: call to 'copy_from_user_overflow' declared with
> attribute warning: copy_from_user() buffer size is not provably
> correct
>
> presumably due to buf_size being signed causing GCC to fail to
> see that buf_size can't become negative.
>
> Cc: Wey-Yi Guy <wey-yi.w.guy@intel.com>
> Signed-off-by: Stephen Boyd <sboyd@codeaurora.org>
Signed-off-by: Wey-Yi Guy <wey-yi.w.guy@intel.com>
> ---
> drivers/net/wireless/iwlwifi/iwl-agn-rs.c | 2 +-
> 1 files changed, 1 insertions(+), 1 deletions(-)
>
Thank you
Wey
^ permalink raw reply [flat|nested] 10+ messages in thread
* [PATCH 6/9] Bluetooth: Silence DEBUG_STRICT_USER_COPY_CHECKS=y warning
2011-05-12 23:50 [PATCH 0/9] strict user copy checks on x86_64 Stephen Boyd
2011-05-12 23:50 ` [PATCH 1/9] iwlegacy: Silence DEBUG_STRICT_USER_COPY_CHECKS=y warning Stephen Boyd
2011-05-12 23:50 ` [PATCH 2/9] iwlwifi: " Stephen Boyd
@ 2011-05-12 23:50 ` Stephen Boyd
[not found] ` <1305244212-19183-7-git-send-email-sboyd-sgV2jX0FEOL9JmXXK+q4OQ@public.gmane.org>
2011-05-24 21:29 ` [PATCH 0/9] strict user copy checks on x86_64 Stephen Boyd
3 siblings, 1 reply; 10+ messages in thread
From: Stephen Boyd @ 2011-05-12 23:50 UTC (permalink / raw)
To: linux-bluetooth; +Cc: linux-kernel, netdev, Marcel Holtmann, Gustavo F. Padovan
Enabling DEBUG_STRICT_USER_COPY_CHECKS causes the following
warning:
In function 'copy_from_user',
inlined from 'rfcomm_sock_setsockopt' at
net/bluetooth/rfcomm/sock.c:705:
arch/x86/include/asm/uaccess_64.h:65:
warning: call to 'copy_from_user_overflow' declared with
attribute warning: copy_from_user() buffer size is not provably
correct
presumably due to buf_size being signed causing GCC to fail to
see that buf_size can't become negative.
Cc: Marcel Holtmann <marcel@holtmann.org>
Cc: Gustavo F. Padovan <padovan@profusion.mobi>
Signed-off-by: Stephen Boyd <sboyd@codeaurora.org>
---
net/bluetooth/rfcomm/sock.c | 3 ++-
1 files changed, 2 insertions(+), 1 deletions(-)
diff --git a/net/bluetooth/rfcomm/sock.c b/net/bluetooth/rfcomm/sock.c
index 66cc1f0..0698b37 100644
--- a/net/bluetooth/rfcomm/sock.c
+++ b/net/bluetooth/rfcomm/sock.c
@@ -679,7 +679,8 @@ static int rfcomm_sock_setsockopt(struct socket *sock, int level, int optname, c
{
struct sock *sk = sock->sk;
struct bt_security sec;
- int len, err = 0;
+ int err = 0;
+ size_t len;
u32 opt;
BT_DBG("sk %p", sk);
--
Sent by an employee of the Qualcomm Innovation Center, Inc.
The Qualcomm Innovation Center, Inc. is a member of the Code Aurora Forum.
^ permalink raw reply related [flat|nested] 10+ messages in thread* Re: [PATCH 0/9] strict user copy checks on x86_64
2011-05-12 23:50 [PATCH 0/9] strict user copy checks on x86_64 Stephen Boyd
` (2 preceding siblings ...)
2011-05-12 23:50 ` [PATCH 6/9] Bluetooth: " Stephen Boyd
@ 2011-05-24 21:29 ` Stephen Boyd
2011-05-24 23:33 ` H. Peter Anvin
3 siblings, 1 reply; 10+ messages in thread
From: Stephen Boyd @ 2011-05-24 21:29 UTC (permalink / raw)
To: Andrew Morton
Cc: linux-kernel, linux-wireless, netdev, Intel Linux Wireless,
linux-scsi, x86, Ingo Molnar
Hi Andrew,
(I don't know who to pick on sorry)
On 05/12/2011 04:50 PM, Stephen Boyd wrote:
> It turns out that strict user copy checks (also known as
> CONFIG_DEBUG_STRICT_USER_COPY_CHECKS) isn't actually implemented
> on x86_64 and thus we aren't catching potential security holes
> at compile time.
>
> This series adds support for strict user copy checks on x86_64
> and silences all the benign warnings in the x86_64 allyesconfig.
>
> The final patch consolidates the config option as its duplicated
> across mutliple arches. I don't know what tree this series should
> go through so I tried to send the individual driver patches to the
> respective maintainers.
>
> Stephen Boyd (9):
> iwlegacy: Silence DEBUG_STRICT_USER_COPY_CHECKS=y warning
> iwlwifi: Silence DEBUG_STRICT_USER_COPY_CHECKS=y warning
> [SCSI] lpfc: Silence DEBUG_STRICT_USER_COPY_CHECKS=y warning
> debugfs: Silence DEBUG_STRICT_USER_COPY_CHECKS=y warning
> kprobes: Silence DEBUG_STRICT_USER_COPY_CHECKS=y warning
> Bluetooth: Silence DEBUG_STRICT_USER_COPY_CHECKS=y warning
> ASoC: Silence DEBUG_STRICT_USER_COPY_CHECKS=y warning
> x86: Implement strict user copy checks for x86_64
> Consolidate CONFIG_DEBUG_STRICT_USER_COPY_CHECKS
It looks like 1, 2, 4, 6, and 7 got picked up. Should I resend the left
over patches with appropriate acked-bys and tags? Would it be
appropriate to push this through your tree?
--
Sent by an employee of the Qualcomm Innovation Center, Inc.
The Qualcomm Innovation Center, Inc. is a member of the Code Aurora Forum.
^ permalink raw reply [flat|nested] 10+ messages in thread* Re: [PATCH 0/9] strict user copy checks on x86_64
2011-05-24 21:29 ` [PATCH 0/9] strict user copy checks on x86_64 Stephen Boyd
@ 2011-05-24 23:33 ` H. Peter Anvin
0 siblings, 0 replies; 10+ messages in thread
From: H. Peter Anvin @ 2011-05-24 23:33 UTC (permalink / raw)
To: Stephen Boyd
Cc: Andrew Morton, linux-kernel, linux-wireless, netdev,
Intel Linux Wireless, linux-scsi, x86, Ingo Molnar
On 05/24/2011 02:29 PM, Stephen Boyd wrote:
>
> It looks like 1, 2, 4, 6, and 7 got picked up. Should I resend the left
> over patches with appropriate acked-bys and tags? Would it be
> appropriate to push this through your tree?
>
I was first going to think I'd pick up 8 and 9 in tip, but since 9 is
cross-architecture, Andrew's tree might be better.
Acked-by: H. Peter Anvin <hpa@zytor.com>
-hpa
^ permalink raw reply [flat|nested] 10+ messages in thread