From: Andrew Morton <akpm@osdl.org>
To: Sorav Bansal <sbansal@stanford.edu>
Cc: tacetan@yahoo.com, linux-kernel@vger.kernel.org
Subject: Re: BUG REPORT: User/Kernel Pointer bug in sys_poll
Date: Thu, 28 Oct 2004 02:48:39 -0700 [thread overview]
Message-ID: <20041028024839.6a1e1064.akpm@osdl.org> (raw)
In-Reply-To: <Pine.GSO.4.44.0410272246240.7124-100000@elaine9.Stanford.EDU>
Sorav Bansal <sbansal@stanford.edu> wrote:
>
> Older x86 architectures (386 and before) allow the kernel to write to any
> user location regardless of the write-protect bits.
>
> Hence, with this bug, a user program could write to the write-protected
> region of its address space by calling the sys_poll system call and
> setting the address and data values appropriately.
Nope. The only significant difference between copy_from_user() and
__put_user() here is that copy_from_user() checks that the address is not
in the 0xc0000000-0xffffffff range. __put_user() skips that check.
So
if (copy_from_user(kaddr, addr, n))
fail();
__put_user(42, addr);
is safe. We know that the address is in the 0x00000000-0xbfffffff range by
the time we call __put_user(). And if the page at *addr it not writeable
the kernel will take a fault.
So I see no hole. But I wouldn't have coded it that way...
next prev parent reply other threads:[~2004-10-28 9:53 UTC|newest]
Thread overview: 7+ messages / expand[flat|nested] mbox.gz Atom feed top
[not found] <20041028052218.52478.qmail@web50207.mail.yahoo.com>
2004-10-28 5:57 ` BUG REPORT: User/Kernel Pointer bug in sys_poll Sorav Bansal
2004-10-28 9:48 ` Andrew Morton [this message]
2004-10-28 10:04 ` Sorav Bansal
2004-10-28 19:24 ` Alan Cox
[not found] <20041028052218.52478.qmail@web50207.mail.yahoo.com.suse.lists.linux.kernel>
[not found] ` <Pine.GSO.4.44.0410272246240.7124-100000@elaine9.Stanford.EDU.suse.lists.linux.kernel>
2004-10-28 6:32 ` Andi Kleen
2004-10-28 8:50 ` Denis Vlasenko
2004-10-28 4:25 Sorav Bansal
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20041028024839.6a1e1064.akpm@osdl.org \
--to=akpm@osdl.org \
--cc=linux-kernel@vger.kernel.org \
--cc=sbansal@stanford.edu \
--cc=tacetan@yahoo.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.