linux-kernel - Re: [PATCH v2] staging: gdm72xx: add userspace data struct

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20151210234738.GA28422@boole.wimdewith.com>
Date:	Fri, 11 Dec 2015 00:47:38 +0100
From:	Wim de With <nauxuron@...dewith.com>
To:	One Thousand Gnomes <gnomes@...rguk.ukuu.org.uk>
Cc:	gregkh@...uxfoundation.org, devel@...verdev.osuosl.org,
	linux-kernel@...r.kernel.org
Subject: Re: [PATCH v2] staging: gdm72xx: add userspace data struct

On Thu, Dec 10, 2015 at 02:44:45PM +0000, One Thousand Gnomes wrote:
> (except that you mean sizeof(struct fsm_s) and it doesn't compile at the
> moment!

Oops, sloppy mistake.

> data_s can just be modified to be __user. All uses of it follow that
> rule.

What do you mean? The data still needs to be copied from user space to kernel
space, if I'm not mistaken. And not all uses follow that rule, since in both
gdm_wimax_ioctl_get_data() and gdm_wimax_ioctl_set_data() it is used as both
the source and destination in the copy_from_user() and copy_to_user() call.

> All I think you need in this case is
> 
> 	struct fsm_s fsm_buf;
> 
> 	if (copy_from_user(&fsm_buf, req->data.buf,sizeof(buf))
> 		return -EFAULT
> 	gdm_update_fsm(&fsm_buf);

Do you mean sizeof(fsm_s)? I realize this would have been far simpler than my
overkill solution.

> If you are touching the structs it might be wise to fix the other
> problems with them notably the use of int. sizes when used are unsigned -
> and signed sizes are asking for errors. In fact if you look at the
> existing uses of the size checks they look deeply suspicious the moment
> anything malicious passes in negative numbers.

I would love to do that, but it is a bit outside the scope of this patch, so I
would rather safe this for another patch.
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/