From: Mike Frysinger <vapier@gentoo.org>
To: Arnd Bergmann <arnd@arndb.de>
Cc: linux-kernel@vger.kernel.org
Subject: [PATCH 2/4] asm-generic: uaccess: add missing access_ok() check to strnlen_user()
Date: Sun, 14 Jun 2009 02:00:02 -0400 [thread overview]
Message-ID: <1244959204-11269-2-git-send-email-vapier@gentoo.org> (raw)
In-Reply-To: <1244959204-11269-1-git-send-email-vapier@gentoo.org>
The strnlen_user() function was missing a access_ok() check on the pointer
given. We've had cases on Blackfin systems where test programs caused
kernel crashes here because userspace passed up a NULL/-1 pointer and the
kernel gladly attempted to run strlen() on it.
Signed-off-by: Mike Frysinger <vapier@gentoo.org>
---
include/asm-generic/uaccess.h | 2 ++
1 files changed, 2 insertions(+), 0 deletions(-)
diff --git a/include/asm-generic/uaccess.h b/include/asm-generic/uaccess.h
index cf3cb73..d299557 100644
--- a/include/asm-generic/uaccess.h
+++ b/include/asm-generic/uaccess.h
@@ -296,6 +296,8 @@ strncpy_from_user(char *dst, const char __user *src, long count)
#ifndef strnlen_user
static inline long strnlen_user(const char __user *src, long n)
{
+ if (!access_ok(VERIFY_READ, src, 1))
+ return 0;
return strlen((void * __force)src) + 1;
}
#endif
--
1.6.3.1
next prev parent reply other threads:[~2009-06-14 6:00 UTC|newest]
Thread overview: 11+ messages / expand[flat|nested] mbox.gz Atom feed top
2009-06-14 6:00 [PATCH 1/4] asm-generic: uaccess: do not expand args multiple times Mike Frysinger
2009-06-14 6:00 ` Mike Frysinger [this message]
2009-06-14 20:35 ` [PATCH 2/4] asm-generic: uaccess: add missing access_ok() check to strnlen_user() Arnd Bergmann
2009-06-14 6:00 ` [PATCH 3/4] asm-generic: uaccess: fix up local access_ok() usage Mike Frysinger
2009-06-14 20:35 ` Arnd Bergmann
2009-06-14 6:00 ` [PATCH 4/4] asm-generic: uaccess: fix access_ok() prototype Mike Frysinger
2009-06-14 20:17 ` Arnd Bergmann
2009-06-16 10:34 ` Mike Frysinger
2009-06-14 20:14 ` [PATCH 1/4] asm-generic: uaccess: do not expand args multiple times Arnd Bergmann
2009-06-24 4:38 ` Al Viro
2009-06-24 11:35 ` Mike Frysinger
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=1244959204-11269-2-git-send-email-vapier@gentoo.org \
--to=vapier@gentoo.org \
--cc=arnd@arndb.de \
--cc=linux-kernel@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox
all inboxes | Powered by JetHome®