Re: [v2] serial_core:recognize invalid pointer from userspace

From	Greg KH <gregkh@linuxfoundation.org>
Newsgroups	linux.kernel
Subject	Re: [v2] serial_core:recognize invalid pointer from userspace
Date	2016-03-10 04:40 +0100
Message-ID	<raZCa-10L-11@gated-at.bofh.it> (permalink)
References	<raZiO-Rs-1@gated-at.bofh.it> <raZiO-Rs-9@gated-at.bofh.it>
Organization	linux.* mail to news gateway

Show all headers | View raw

On Thu, Mar 10, 2016 at 11:17:23AM +0800, Jiang Lu wrote:
> compat_ioctl use 0xffffffff as a magic number to mark invalid pointer
> for iomem_base in serial_struct when truncating a 64bit pointer into
> 32bit.
> 
> Serial driver need recognize this invalid pointer when parsing
> serial_struct from userspace.
> 
> Signed-off-by: Jiang Lu <lu.jiang@windriver.com>
> ---
>  drivers/tty/serial/serial_core.c | 3 +++
>  1 file changed, 3 insertions(+)
> 
> diff --git a/drivers/tty/serial/serial_core.c b/drivers/tty/serial/serial_core.c
> index a5d545e..d293536 100644
> --- a/drivers/tty/serial/serial_core.c
> +++ b/drivers/tty/serial/serial_core.c
> @@ -745,6 +745,9 @@ static int uart_set_info(struct tty_struct *tty, struct tty_port *port,
>  	 * allocations, we should treat type changes the same as
>  	 * IO port changes.
>  	 */
> +	if ((unsigned long)new_info->iomem_base == 0xffffffff)
> +		new_info->iomem_base = (void *)(unsigned long)uport->mapbase;

This looks really odd to me, why do we care about userspace issues here?
Shouldn't the compat ioctl code have handled this already all for us?

And why set it to mapbase?  Just to keep it from being changed?

this worries me...

greg k-h

Thread

[v2]serial_core:recognize invalid pointer from userspace Jiang Lu <lu.jiang@windriver.com> - 2016-03-10 04:20 +0100
  [v2] serial_core:recognize invalid pointer from userspace Jiang Lu <lu.jiang@windriver.com> - 2016-03-10 04:20 +0100
    Re: [v2] serial_core:recognize invalid pointer from userspace Greg KH <gregkh@linuxfoundation.org> - 2016-03-10 04:40 +0100
      Re: [v2] serial_core:recognize invalid pointer from userspace "Lu.Jiang" <lu.jiang@windriver.com> - 2016-03-10 06:00 +0100
        Re: [v2] serial_core:recognize invalid pointer from userspace One Thousand Gnomes <gnomes@lxorguk.ukuu.org.uk> - 2016-03-10 14:50 +0100
          Re: [v2] serial_core:recognize invalid pointer from userspace "Lu.Jiang" <lu.jiang@windriver.com> - 2016-03-11 03:40 +0100

csiph-web