From: Dave Airlie <airlied@gmail.com>
To: Arjan van de Ven <arjan@infradead.org>
Cc: linux-kernel@vger.kernel.org, torvalds@linux-foundation.org,
mingo@elte.hu, jmorris@nami.org
Subject: Re: [PATCH 7/9] Simplify bound checks in capabilities for copy_from_user
Date: Tue, 29 Sep 2009 15:55:49 +1000 [thread overview]
Message-ID: <21d7e9970909282255y6718b11cvadafae0e1648817c@mail.gmail.com> (raw)
In-Reply-To: <20090926205336.77bc5b21@infradead.org>
On Sun, Sep 27, 2009 at 4:53 AM, Arjan van de Ven <arjan@infradead.org> wrote:
> From: Arjan van de Ven <arjan@linux.intel.com>
> Subject: [PATCH 7/9] Simplify bound checks in capabilities for copy_from_user
> CC: James Morris <jmorris@namei.org>
>
> The capabilities syscall has a copy_from_user() call where gcc currently
> cannot prove to itself that the copy is always within bounds.
>
> This patch adds a very explicity bound check to prove to gcc that
> this copy_from_user cannot overflow its destination buffer.
>
> Signed-off-by: Arjan van de Ven <arjan@linux.intel.com>
>
> diff --git a/kernel/capability.c b/kernel/capability.c
> index 4e17041..204f11f 100644
> --- a/kernel/capability.c
> +++ b/kernel/capability.c
> @@ -238,7 +241,7 @@ SYSCALL_DEFINE2(capget, cap_user_header_t, header, cap_user_data_t, dataptr)
> SYSCALL_DEFINE2(capset, cap_user_header_t, header, const cap_user_data_t, data)
> {
> struct __user_cap_data_struct kdata[_KERNEL_CAPABILITY_U32S];
> - unsigned i, tocopy;
> + unsigned i, tocopy, copybytes;
> kernel_cap_t inheritable, permitted, effective;
> struct cred *new;
> int ret;
> @@ -255,8 +258,11 @@ SYSCALL_DEFINE2(capset, cap_user_header_t, header, const cap_user_data_t, data)
> if (pid != 0 && pid != task_pid_vnr(current))
> return -EPERM;
>
> - if (copy_from_user(&kdata, data,
> - tocopy * sizeof(struct __user_cap_data_struct)))
> + copybytes = tocopy * sizeof(struct __user_cap_data_struct);
> + if (copybytes > _KERNEL_CAPABILITY_U32S)
> + return -EFAULT;
This is broken, it breaks dbus at least for me. you compare bytes
to u32s wrongly.
Dave.
> +
> + if (copy_from_user(&kdata, data, copybytes))
> return -EFAULT;
>
> for (i = 0; i < tocopy; i++) {
>
>
>
> --
> Arjan van de Ven Intel Open Source Technology Centre
> For development, discussion and tips for power savings,
> visit http://www.lesswatts.org
> --
> To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
> the body of a message to majordomo@vger.kernel.org
> More majordomo info at http://vger.kernel.org/majordomo-info.html
> Please read the FAQ at http://www.tux.org/lkml/
>
next prev parent reply other threads:[~2009-09-29 5:55 UTC|newest]
Thread overview: 22+ messages / expand[flat|nested] mbox.gz Atom feed top
2009-09-26 18:49 [PATCH 0/9] Series to make copy_from_user to a stack slot provable right Arjan van de Ven
2009-09-26 18:50 ` [PATCH 1/9] Fix bound checks for copy_from_user in the acpi /proc code Arjan van de Ven
2009-09-26 18:50 ` [PATCH 2/9] Simplify bound checks in nvram for copy_from_user Arjan van de Ven
2009-09-26 18:51 ` [PATCH 3/9] Add bound checks in wext " Arjan van de Ven
2009-09-26 18:51 ` [PATCH 4/9] Simplify bound checks in the MTRR code Arjan van de Ven
2009-10-02 18:36 ` [tip:x86/urgent] x86: " tip-bot for Arjan van de Ven
2009-09-26 18:52 ` [PATCH 5/9] Add bound checks in acpi/video for copy_from_user Arjan van de Ven
2009-09-26 18:52 ` [PATCH 6/9] Simplify bound checks in cifs " Arjan van de Ven
2009-09-26 18:53 ` [PATCH 7/9] Simplify bound checks in capabilities " Arjan van de Ven
2009-09-29 5:55 ` Dave Airlie [this message]
2009-09-29 9:24 ` Arjan van de Ven
2009-10-01 22:34 ` James Morris
2009-09-26 18:54 ` [PATCH 8/9] Add explicit bound checks in mm/migrate.c Arjan van de Ven
2009-09-30 22:20 ` Andrew Morton
2009-10-01 5:54 ` KOSAKI Motohiro
[not found] ` <tip-b925585039cf39275c2e0e57512e5df27fa73aad@git.kernel.org>
2009-12-13 23:38 ` [tip:x86/urgent] mm: Adjust do_pages_stat() so gcc can see copy_from_user() is safe KOSAKI Motohiro
2009-09-26 18:54 ` [PATCH 9/9] Add explicit bound checks in net/socket.c Arjan van de Ven
2009-09-26 19:01 ` Cyrill Gorcunov
2009-09-26 19:05 ` Arjan van de Ven
2009-09-26 19:23 ` Arjan van de Ven
2009-09-26 19:35 ` Cyrill Gorcunov
2009-09-28 19:57 ` David Miller
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=21d7e9970909282255y6718b11cvadafae0e1648817c@mail.gmail.com \
--to=airlied@gmail.com \
--cc=arjan@infradead.org \
--cc=jmorris@nami.org \
--cc=linux-kernel@vger.kernel.org \
--cc=mingo@elte.hu \
--cc=torvalds@linux-foundation.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox
all inboxes | Powered by JetHome®