linux-kernel - Re: [PATCH v2] drivers/media/video/v4l2-compat-ioctl32.c: Check the return value of copy_to

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <4D1207D9.2050000@linuxtv.org>
Date:	Wed, 22 Dec 2010 15:14:49 +0100
From:	Andreas Oberritter <obi@...uxtv.org>
To:	Thiago Farina <tfransosi@...il.com>
CC:	linux-kernel@...r.kernel.org, arnd@...db.de,
	Guennadi Liakhovetski <g.liakhovetski@....de>,
	Mauro Carvalho Chehab <mchehab@...radead.org>,
	linux-media@...r.kernel.org
Subject: Re: [PATCH v2] drivers/media/video/v4l2-compat-ioctl32.c: Check the
 return value of copy_to_user

On 12/22/2010 12:48 AM, Thiago Farina wrote:
> This fix the following warning:
> drivers/media/video/v4l2-compat-ioctl32.c: In function ‘get_microcode32’:
> drivers/media/video/v4l2-compat-ioctl32.c:209: warning: ignoring return value of ‘copy_to_user’, declared with attribute warn_unused_result
> 
> Signed-off-by: Thiago Farina <tfransosi@...il.com>
> ---
>  Changes from v1:
>  - Check the return code of put_user too.
>  - Remove the obsolete comment.
> 
>  drivers/media/video/v4l2-compat-ioctl32.c |   14 ++++++--------
>  1 files changed, 6 insertions(+), 8 deletions(-)
> 
> diff --git a/drivers/media/video/v4l2-compat-ioctl32.c b/drivers/media/video/v4l2-compat-ioctl32.c
> index e30e8df..6f2a022 100644
> --- a/drivers/media/video/v4l2-compat-ioctl32.c
> +++ b/drivers/media/video/v4l2-compat-ioctl32.c
> @@ -201,14 +201,12 @@ static struct video_code __user *get_microcode32(struct video_code32 *kp)
>  
>  	up = compat_alloc_user_space(sizeof(*up));

I don't know anything about that code, but I assume that "up" should be
checked for NULL before use and should be freed in case an error occurs
below.

>  
> -	/*
> -	 * NOTE! We don't actually care if these fail. If the
> -	 * user address is invalid, the native ioctl will do
> -	 * the error handling for us
> -	 */
> -	(void) copy_to_user(up->loadwhat, kp->loadwhat, sizeof(up->loadwhat));
> -	(void) put_user(kp->datasize, &up->datasize);
> -	(void) put_user(compat_ptr(kp->data), &up->data);
> +	if (copy_to_user(up->loadwhat, kp->loadwhat, sizeof(up->loadwhat)))
> +		return NULL;
> +	if (put_user(kp->datasize, &up->datasize))
> +		return NULL;
> +	if (put_user(compat_ptr(kp->data), &up->data))
> +		return NULL;
>  	return up;
>  }
>  

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/