linux-kernel - Re: [Linux-fbdev-devel] [PATCH] viafb: Use sizeof struct rather than pointer

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <4B087ECA.1070109@gmx.de>
Date:	Sun, 22 Nov 2009 00:59:06 +0100
From:	Florian Tobias Schandinat <FlorianSchandinat@....de>
To:	Roel Kluin <roel.kluin@...il.com>
CC:	Joseph Chan <JosephChan@....com.tw>,
	Andrew Morton <akpm@...ux-foundation.org>,
	Scott Fang <ScottFang@...tech.com.cn>,
	linux-fbdev-devel@...ts.sourceforge.net,
	LKML <linux-kernel@...r.kernel.org>
Subject: Re: [Linux-fbdev-devel] [PATCH] viafb: Use sizeof struct rather	than
 pointer

Hi,

Roel Kluin schrieb:
> diff --git a/drivers/video/via/viafbdev.c b/drivers/video/via/viafbdev.c
> index 56ec696..7b181e7 100644
> --- a/drivers/video/via/viafbdev.c
> +++ b/drivers/video/via/viafbdev.c
> @@ -680,7 +680,7 @@ static int viafb_ioctl(struct fb_info *info, u_int cmd, u_long arg)
>  		if (!viafb_gamma_table)
>  			return -ENOMEM;
>  		if (copy_from_user(viafb_gamma_table, argp,
> -				sizeof(viafb_gamma_table))) {
> +				sizeof(*viafb_gamma_table))) {
>  			kfree(viafb_gamma_table);
>  			return -EFAULT;
>  		}
> @@ -694,7 +694,7 @@ static int viafb_ioctl(struct fb_info *info, u_int cmd, u_long arg)
>  			return -ENOMEM;
>  		viafb_get_gamma_table(viafb_gamma_table);
>  		if (copy_to_user(argp, viafb_gamma_table,
> -			sizeof(viafb_gamma_table))) {
> +			sizeof(*viafb_gamma_table))) {
>  			kfree(viafb_gamma_table);
>  			return -EFAULT;
>  		}

I'm sorry but I fear your fix isn't correct. The reason is a few lines 
above:

u32 *viafb_gamma_table;
...
viafb_gamma_table = kmalloc(256 * sizeof(u32), GFP_KERNEL);

so probably the right solution would look like this:

copy_from_user(viafb_gamma_table, argp, 256 * sizeof(u32))
copy_to_user(argp, viafb_gamma_table, 256 * sizeof(u32))

However viafb has way too many private ioctls. I would be curious 
whether there exists any program that uses any of them so that they 
could be tested. As this ioctl didn't work very well I vote to remove it 
at least temporarily.

Thanks for highlighting this problem,


Florian Tobias Schandinat
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/