* [PATCH] drivers/fpga: copy userspace array safely
@ 2023-11-02 18:49 Philipp Stanner
2023-11-14 7:22 ` Xu Yilun
0 siblings, 1 reply; 2+ messages in thread
From: Philipp Stanner @ 2023-11-02 18:49 UTC (permalink / raw)
To: Wu Hao, Tom Rix, Moritz Fischer, Xu Yilun
Cc: linux-fpga, linux-kernel, Philipp Stanner, Dave Airlie
dfl.c utilizes memdup_user() and array_size() to copy a userspace array.
Currently, this does not check for an overflow.
Use the new wrapper memdup_array_user() to copy the array more safely.
Suggested-by: Dave Airlie <airlied@redhat.com>
Signed-off-by: Philipp Stanner <pstanner@redhat.com>
---
Linus recently merged this new wrapper for Kernel v6.7
---
drivers/fpga/dfl.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/drivers/fpga/dfl.c b/drivers/fpga/dfl.c
index dd7a783d53b5..e69b9f1f2a50 100644
--- a/drivers/fpga/dfl.c
+++ b/drivers/fpga/dfl.c
@@ -2008,8 +2008,8 @@ long dfl_feature_ioctl_set_irq(struct platform_device *pdev,
(hdr.start + hdr.count < hdr.start))
return -EINVAL;
- fds = memdup_user((void __user *)(arg + sizeof(hdr)),
- array_size(hdr.count, sizeof(s32)));
+ fds = memdup_array_user((void __user *)(arg + sizeof(hdr)),
+ hdr.count, sizeof(s32));
if (IS_ERR(fds))
return PTR_ERR(fds);
--
2.41.0
^ permalink raw reply [flat|nested] 2+ messages in thread
* Re: [PATCH] drivers/fpga: copy userspace array safely
2023-11-02 18:49 [PATCH] drivers/fpga: copy userspace array safely Philipp Stanner
@ 2023-11-14 7:22 ` Xu Yilun
0 siblings, 0 replies; 2+ messages in thread
From: Xu Yilun @ 2023-11-14 7:22 UTC (permalink / raw)
To: Philipp Stanner
Cc: Wu Hao, Tom Rix, Moritz Fischer, Xu Yilun, linux-fpga,
linux-kernel, Dave Airlie
On Thu, Nov 02, 2023 at 07:49:09PM +0100, Philipp Stanner wrote:
> dfl.c utilizes memdup_user() and array_size() to copy a userspace array.
> Currently, this does not check for an overflow.
array_size() actually checks for overflow, so please re-write the changelog.
Thanks,
Yilun
>
> Use the new wrapper memdup_array_user() to copy the array more safely.
>
> Suggested-by: Dave Airlie <airlied@redhat.com>
> Signed-off-by: Philipp Stanner <pstanner@redhat.com>
> ---
> Linus recently merged this new wrapper for Kernel v6.7
> ---
> drivers/fpga/dfl.c | 4 ++--
> 1 file changed, 2 insertions(+), 2 deletions(-)
>
> diff --git a/drivers/fpga/dfl.c b/drivers/fpga/dfl.c
> index dd7a783d53b5..e69b9f1f2a50 100644
> --- a/drivers/fpga/dfl.c
> +++ b/drivers/fpga/dfl.c
> @@ -2008,8 +2008,8 @@ long dfl_feature_ioctl_set_irq(struct platform_device *pdev,
> (hdr.start + hdr.count < hdr.start))
> return -EINVAL;
>
> - fds = memdup_user((void __user *)(arg + sizeof(hdr)),
> - array_size(hdr.count, sizeof(s32)));
> + fds = memdup_array_user((void __user *)(arg + sizeof(hdr)),
> + hdr.count, sizeof(s32));
> if (IS_ERR(fds))
> return PTR_ERR(fds);
>
> --
> 2.41.0
>
^ permalink raw reply [flat|nested] 2+ messages in thread
end of thread, other threads:[~2023-11-14 7:24 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2023-11-02 18:49 [PATCH] drivers/fpga: copy userspace array safely Philipp Stanner
2023-11-14 7:22 ` Xu Yilun
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox
all inboxes | Powered by JetHome®