On Wed, Jan 25, 2006 at 12:35:38AM +0100, Rafael J. Wysocki wrote:
> > > + if (!access_ok(VERIFY_WRITE, (unsigned long __user *)arg, _IOC_SIZE(cmd))) {
> > > + error = -EINVAL;
> > > + break;
> > > + }
> >
> > Why do we need an access_ok() here?
>
> Because we use __put_user() down the road?
>
> The problem is if the address is wrong we should not try to call
> alloc_swap_page() at all. If we did, we wouldn't be able to return the result
> and we would leak a swap page.
Then access_ok() is not the droid you are looking for... since it won't
catch several cases (out of memory being the most obvious). Doing an
early put_user() wouldn't hurt and reduces the chance of later failure
even further. __put_user() should never be used outside of a select few
performance critical code paths.
-ben
--
"Ladies and gentlemen, I'm sorry to interrupt, but the police are here
and they've asked us to stop the party." Don't Email: <[email protected]>.
-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to [email protected]
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/
[Index of Archives]
[Kernel Newbies]
[Netfilter]
[Bugtraq]
[Photo]
[Stuff]
[Gimp]
[Yosemite News]
[MIPS Linux]
[ARM Linux]
[Linux Security]
[Linux RAID]
[Video 4 Linux]
[Linux for the blind]
[Linux Resources]
