linux-kernel - Re: [git pull] vfs.git regression fix Re: Regression related to ipc shmctl compat

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20171011170649.GC21978@ZenIV.linux.org.uk>
Date:   Wed, 11 Oct 2017 18:06:49 +0100
From:   Al Viro <viro@...IV.linux.org.uk>
To:     Linus Torvalds <torvalds@...ux-foundation.org>
Cc:     Kyle Huey <me@...ehuey.com>,
        open list <linux-kernel@...r.kernel.org>,
        Robert O'Callahan <robert@...llahan.org>
Subject: Re: [git pull] vfs.git regression fix Re: Regression related to ipc
 shmctl compat

On Wed, Oct 11, 2017 at 06:03:35PM +0100, Al Viro wrote:
> On Mon, Sep 25, 2017 at 07:02:16PM -0700, Linus Torvalds wrote:
> > On Mon, Sep 25, 2017 at 6:46 PM, Al Viro <viro@...iv.linux.org.uk> wrote:
> > >
> > > Which tree do you prefer it to go through?  Direct to mainline, or vfs.git
> > > #for-next?
> > 
> > for-next, it's not like it's in any way urgent.
> 
> Can I assume your normal S-o-b on that?  Just noticed that thing sitting
> in misc queue with mismatched Author: and Signed-off-by:...

FWIW, what I've got in there is

Author: Linus Torvalds <torvalds@...ux-foundation.org>
Date:   Mon Sep 25 18:37:28 2017 -0700

    fix address space warnings in ipc/
    
    Signed-off-by: Al Viro <viro@...iv.linux.org.uk>

diff --git a/ipc/msg.c b/ipc/msg.c
index 06be5a9adfa4..ebb7ea24ee28 100644
--- a/ipc/msg.c
+++ b/ipc/msg.c
@@ -590,13 +590,13 @@ static int copy_compat_msqid_from_user(struct msqid64_ds *out, void __user *buf,
 {
 	memset(out, 0, sizeof(*out));
 	if (version == IPC_64) {
-		struct compat_msqid64_ds *p = buf;
+		struct compat_msqid64_ds __user *p = buf;
 		if (get_compat_ipc64_perm(&out->msg_perm, &p->msg_perm))
 			return -EFAULT;
 		if (get_user(out->msg_qbytes, &p->msg_qbytes))
 			return -EFAULT;
 	} else {
-		struct compat_msqid_ds *p = buf;
+		struct compat_msqid_ds __user *p = buf;
 		if (get_compat_ipc_perm(&out->msg_perm, &p->msg_perm))
 			return -EFAULT;
 		if (get_user(out->msg_qbytes, &p->msg_qbytes))
diff --git a/ipc/sem.c b/ipc/sem.c
index f7385bce5fd3..6220e9616207 100644
--- a/ipc/sem.c
+++ b/ipc/sem.c
@@ -1636,10 +1636,10 @@ static int copy_compat_semid_from_user(struct semid64_ds *out, void __user *buf,
 {
 	memset(out, 0, sizeof(*out));
 	if (version == IPC_64) {
-		struct compat_semid64_ds *p = buf;
+		struct compat_semid64_ds __user *p = buf;
 		return get_compat_ipc64_perm(&out->sem_perm, &p->sem_perm);
 	} else {
-		struct compat_semid_ds *p = buf;
+		struct compat_semid_ds __user *p = buf;
 		return get_compat_ipc_perm(&out->sem_perm, &p->sem_perm);
 	}
 }
diff --git a/ipc/shm.c b/ipc/shm.c
index 1b3adfe3c60e..41706416a3c4 100644
--- a/ipc/shm.c
+++ b/ipc/shm.c
@@ -1193,10 +1193,10 @@ static int copy_compat_shmid_from_user(struct shmid64_ds *out, void __user *buf,
 {
 	memset(out, 0, sizeof(*out));
 	if (version == IPC_64) {
-		struct compat_shmid64_ds *p = buf;
+		struct compat_shmid64_ds __user *p = buf;
 		return get_compat_ipc64_perm(&out->shm_perm, &p->shm_perm);
 	} else {
-		struct compat_shmid_ds *p = buf;
+		struct compat_shmid_ds __user *p = buf;
 		return get_compat_ipc_perm(&out->shm_perm, &p->shm_perm);
 	}
 }
diff --git a/ipc/syscall.c b/ipc/syscall.c
index 667022746ca5..977bffd5a7f8 100644
--- a/ipc/syscall.c
+++ b/ipc/syscall.c
@@ -171,7 +171,7 @@ COMPAT_SYSCALL_DEFINE6(ipc, u32, call, int, first, int, second,
 			       COMPAT_SHMLBA);
 		if (err < 0)
 			return err;
-		return put_user(raddr, (compat_ulong_t *)compat_ptr(third));
+		return put_user(raddr, (compat_ulong_t __user *)compat_ptr(third));
 	}
 	case SHMDT:
 		return sys_shmdt(compat_ptr(ptr));