linux-kernel - Re: [PATCH v06 19/36] uapi linux/omapfb.h: use __kernel_size_t instead of size

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Wed, 9 Aug 2017 02:11:58 +0300
From:   "Dmitry V. Levin" <ldv@...linux.org>
To:     Mikko Rapeli <mikko.rapeli@....fi>
Cc:     linux-kernel@...r.kernel.org, linux-api@...r.kernel.org,
        linux-omap@...r.kernel.org, Tomi Valkeinen <tomi.valkeinen@...com>,
        Aaro Koskinen <aaro.koskinen@....fi>
Subject: Re: [PATCH v06 19/36] uapi linux/omapfb.h: use __kernel_size_t
 instead of size_t

On Sun, Aug 06, 2017 at 06:44:10PM +0200, Mikko Rapeli wrote:
> Fixes userspace compilation error:
> 
> error: unknown type name ‘size_t’
> 
> Signed-off-by: Mikko Rapeli <mikko.rapeli@....fi>
> Cc: linux-omap@...r.kernel.org
> Cc: Tomi Valkeinen <tomi.valkeinen@...com>
> Cc: Aaro Koskinen <aaro.koskinen@....fi>
> ---
>  include/uapi/linux/omapfb.h | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/include/uapi/linux/omapfb.h b/include/uapi/linux/omapfb.h
> index 7c97bc00ac6d..b637a924618f 100644
> --- a/include/uapi/linux/omapfb.h
> +++ b/include/uapi/linux/omapfb.h
> @@ -181,7 +181,7 @@ struct omapfb_memory_read {
>  	__u16 y;
>  	__u16 w;
>  	__u16 h;
> -	size_t buffer_size;
> +	__kernel_size_t buffer_size;
>  	void __user *buffer;
>  };

You generally cannot replace size_t with __kernel_size_t in a header that
affects x32, but this case is really bad one: the kernel treats
struct omapfb_memory_read.buffer_size as __kernel_size_t, while
x32 userspace treats it as size_t.  As result, the offset of
struct omapfb_memory_read.buffer on x32 is different between the kernel
and userspace.

In other words, the whole thing seems to be totally broken on x32 already
and it's not important whether you use __kernel_size_t or
__kernel_uapi_size_t as a type of struct omapfb_memory_read.buffer_size.

This deserves a word in the commit message, though.

-- 
ldv

Download attachment "signature.asc" of type "application/pgp-signature" (802 bytes)