Re: Finding user/kernel pointer bugs [no html]

[Linus Torvalds <torvalds@osdl.org>]

On Wed, 9 Jun 2004, Robert T. Johnson wrote:
> 
> QUESTION:  Do you find it's difficult to figure out which fields of
> structures should be declared __user?

It's _usually_ trivial, by just looking at the warnings. 

Not always, though. We don't have a "taint" attribute (I've been thinking 
about it, but I don't feel the pain has been worth it yet), so if you do 
load a structure from user space (properly, with copy_from_user()) and 
then use a non-annotated part of that as a pointer and dereference it 
directly, sparse won't warn, of course. 

However, that requires that _every_ single user of that attribute member 
mis-uses the pointer (ie that "get_user()" never sees that pointer at 
all)). So that case is fairly unlikely, although it can (and probably 
does) happen for the unusual stuff.

The much harder issue is structures that soemtimes contain user pointers,
and sometime contain kernel pointers. Those sparse can't handle at all,
since sparse does purely local and static type-checking. It will complain
about one or the other.

The only way to fix the second case is to split the structure up - which
is usually a good idea _anyway_, but which can sometimes be pretty 
painful. Al has done some of them. The really painful one is "struct 
iovec", which seems to be used in this capacity a fair amount.

> If a structure pointer is __user, but it has some pointer fields that
> aren't declared __user, there's a good chance that there's a missing
> annotation or something.

Yes. That's likely a good heuristic.

			Linus