[PATCH 1/1] setitimer : Return -EFAULT if the user pointer "value" is NULL

[PATCH 1/1] setitimer : Return -EFAULT if the user pointer "value" is NULL

[Sasikantha babu]

Added WARN_ONCE() in the else path and schedule the removal of this "feature" for v3.6

Signed-off-by: Sasikantha babu <sasikanth.v19@gmail.com>
---
 Documentation/feature-removal-schedule.txt |    9 +++++++++
 kernel/itimer.c                            |    5 ++++-
 2 files changed, 13 insertions(+), 1 deletions(-)

diff --git a/Documentation/feature-removal-schedule.txt b/Documentation/feature-removal-schedule.txt
index d5dc80f..d943987 100644
--- a/Documentation/feature-removal-schedule.txt
+++ b/Documentation/feature-removal-schedule.txt
@@ -535,3 +535,12 @@ Why:	This driver provides support for USB storage devices like "USB
         (CONFIG_USB_STORAGE) which only drawback is the additional SCSI
         stack.
 Who:	Sebastian Andrzej Siewior <sebastian@breakpoint.cc>
+
+----------------------------
+
+What:	setitimer accepts user's NULL pointer - interval timer pointer 
+When:	3.6
+Why:	setitimer is not returning -EFAULT if user point is NULL. If user passes
+	"struct itimerval *value" as NULL instead of returning -EFAULT it 
+	sets value of an interval timer to 0 secs and 0 micro secs.
+Who:	Sasikantha Babu <sasikanth.v19@gmail.com>
diff --git a/kernel/itimer.c b/kernel/itimer.c
index 22000c3..10f3cfb 100644
--- a/kernel/itimer.c
+++ b/kernel/itimer.c
@@ -284,8 +284,11 @@ SYSCALL_DEFINE3(setitimer, int, which, struct itimerval __user *, value,
 	if (value) {
 		if(copy_from_user(&set_buffer, value, sizeof(set_buffer)))
 			return -EFAULT;
-	} else
+	} else {
 		memset((char *) &set_buffer, 0, sizeof(set_buffer));
+		WARN_ONCE (!value, "setitimer: Support for handling NULL user pointer "
+				    " will be removed");
+	}
 
 	error = do_setitimer(which, &set_buffer, ovalue ? &get_buffer : NULL);
 	if (error || !ovalue)
-- 
1.7.3.4

[tip:timers/core] itimer: Schedule silent NULL pointer fixup in setitimer() for removal

[tip-bot for Sasikantha babu]

Commit-ID:  aa2bf9bc6414b6972b9e51903c1ce7b1f057aee2
Gitweb:     http://git.kernel.org/tip/aa2bf9bc6414b6972b9e51903c1ce7b1f057aee2
Author:     Sasikantha babu <sasikanth.v19@gmail.com>
AuthorDate: Wed, 21 Mar 2012 20:10:54 +0530
Committer:  Thomas Gleixner <tglx@linutronix.de>
CommitDate: Fri, 30 Mar 2012 15:43:33 +0200

itimer: Schedule silent NULL pointer fixup in setitimer() for removal

setitimer() should return -EFAULT if called with an invalid pointer
for value. The current code excludes a NULL pointer from this rule and
silently uses it to stop the timer. This violates the spec.

Warn about user space apps which rely on that feature and schedule it
for removal.

[ tglx: Massaged changelog, warn message and Doc entry ]

Signed-off-by: Sasikantha babu <sasikanth.v19@gmail.com>
Link: http://lkml.kernel.org/r/1332340854-26053-1-git-send-email-sasikanth.v19@gmail.com
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
---
 Documentation/feature-removal-schedule.txt |    8 ++++++++
 kernel/itimer.c                            |    5 ++++-
 2 files changed, 12 insertions(+), 1 deletions(-)

diff --git a/Documentation/feature-removal-schedule.txt b/Documentation/feature-removal-schedule.txt
index 0cad480..32fae81 100644
--- a/Documentation/feature-removal-schedule.txt
+++ b/Documentation/feature-removal-schedule.txt
@@ -529,3 +529,11 @@ When:	3.5
 Why:	The old kmap_atomic() with two arguments is deprecated, we only
 	keep it for backward compatibility for few cycles and then drop it.
 Who:	Cong Wang <amwang@redhat.com>
+
+----------------------------
+
+What:	setitimer accepts user NULL pointer (value)
+When:	3.6
+Why:	setitimer is not returning -EFAULT if user pointer is NULL. This
+	violates the spec.
+Who:	Sasikantha Babu <sasikanth.v19@gmail.com>
diff --git a/kernel/itimer.c b/kernel/itimer.c
index 22000c3..c70369a 100644
--- a/kernel/itimer.c
+++ b/kernel/itimer.c
@@ -284,8 +284,11 @@ SYSCALL_DEFINE3(setitimer, int, which, struct itimerval __user *, value,
 	if (value) {
 		if(copy_from_user(&set_buffer, value, sizeof(set_buffer)))
 			return -EFAULT;
-	} else
+	} else {
 		memset((char *) &set_buffer, 0, sizeof(set_buffer));
+		WARN_ONCE(1, "setitimer: new_value pointer is NULL."
+			  " Misfeature support will be removed\n");
+	}
 
 	error = do_setitimer(which, &set_buffer, ovalue ? &get_buffer : NULL);
 	if (error || !ovalue)