2006-11-21 05:15:40

by Yoichi Yuasa

Subject: [PATCH] add return value checking of get_user() in set_vesa_blanking()

Hi,

This patch has added return value checking of get_user() in set_vesa_blanking().

Yoichi

Signed-off-by: Yoichi Yuasa <[email protected]>

diff -pruN -X generic/Documentation/dontdiff generic-orig/drivers/char/vt.c generic/drivers/char/vt.c
--- generic-orig/drivers/char/vt.c 2006-11-21 10:23:39.409667250 +0900
+++ generic/drivers/char/vt.c 2006-11-21 10:11:48.037209250 +0900
@@ -3318,9 +3318,10 @@ postcore_initcall(vtconsole_class_init);

static void set_vesa_blanking(char __user *p)
{
- unsigned int mode;
- get_user(mode, p + 1);
- vesa_blank_mode = (mode < 4) ? mode : 0;
+ unsigned int mode;
+
+ if (!get_user(mode, p + 1))
+ vesa_blank_mode = (mode < 4) ? mode : 0;
}

void do_blank_screen(int entering_gfx)

2006-11-22 01:31:20

by Andrew Morton

Subject: Re: [PATCH] add return value checking of get_user() in set_vesa_blanking()

On Tue, 21 Nov 2006 14:15:28 +0900
Yoichi Yuasa <[email protected]> wrote:

> Hi,
>
> This patch has added return value checking of get_user() in set_vesa_blanking().
>
> Yoichi
>
> Signed-off-by: Yoichi Yuasa <[email protected]>
>
> diff -pruN -X generic/Documentation/dontdiff generic-orig/drivers/char/vt.c generic/drivers/char/vt.c
> --- generic-orig/drivers/char/vt.c 2006-11-21 10:23:39.409667250 +0900
> +++ generic/drivers/char/vt.c 2006-11-21 10:11:48.037209250 +0900
> @@ -3318,9 +3318,10 @@ postcore_initcall(vtconsole_class_init);
>
> static void set_vesa_blanking(char __user *p)
> {
> - unsigned int mode;
> - get_user(mode, p + 1);
> - vesa_blank_mode = (mode < 4) ? mode : 0;
> + unsigned int mode;
> +
> + if (!get_user(mode, p + 1))
> + vesa_blank_mode = (mode < 4) ? mode : 0;
> }
>
> void do_blank_screen(int entering_gfx)

How about we go all the way?

diff -puN drivers/char/vt.c~add-return-value-checking-of-get_user-in drivers/char/vt.c
--- a/drivers/char/vt.c~add-return-value-checking-of-get_user-in
+++ a/drivers/char/vt.c
@@ -152,7 +152,7 @@ static void gotoxy(struct vc_data *vc, i
static void save_cur(struct vc_data *vc);
static void reset_terminal(struct vc_data *vc, int do_clear);
static void con_flush_chars(struct tty_struct *tty);
-static void set_vesa_blanking(char __user *p);
+static int set_vesa_blanking(char __user *p);
static void set_cursor(struct vc_data *vc);
static void hide_cursor(struct vc_data *vc);
static void console_callback(void *ignored);
@@ -2369,7 +2369,7 @@ int tioclinux(struct tty_struct *tty, un
ret = __put_user(data, p);
break;
case TIOCL_SETVESABLANK:
- set_vesa_blanking(p);
+ ret = set_vesa_blanking(p);
break;
case TIOCL_GETKMSGREDIRECT:
data = kmsg_redirect;
@@ -3315,9 +3315,13 @@ postcore_initcall(vtconsole_class_init);

static void set_vesa_blanking(char __user *p)
{
- unsigned int mode;
- get_user(mode, p + 1);
- vesa_blank_mode = (mode < 4) ? mode : 0;
+ unsigned int mode;
+
+ if (get_user(mode, p + 1))
+ return -EFAULT;
+
+ vesa_blank_mode = (mode < 4) ? mode : 0;
+ return 0;
}

void do_blank_screen(int entering_gfx)
_

2006-11-22 05:17:49

by Yoichi Yuasa

Subject: Re: [PATCH] add return value checking of get_user() in set_vesa_blanking()

On Tue, 21 Nov 2006 17:31:15 -0800
Andrew Morton <[email protected]> wrote:

> On Tue, 21 Nov 2006 14:15:28 +0900
> Yoichi Yuasa <[email protected]> wrote:
>
> > Hi,
> >
> > This patch has added return value checking of get_user() in set_vesa_blanking().
> >
> > Yoichi
> >
> > Signed-off-by: Yoichi Yuasa <[email protected]>
> >
> > diff -pruN -X generic/Documentation/dontdiff generic-orig/drivers/char/vt.c generic/drivers/char/vt.c
> > --- generic-orig/drivers/char/vt.c 2006-11-21 10:23:39.409667250 +0900
> > +++ generic/drivers/char/vt.c 2006-11-21 10:11:48.037209250 +0900
> > @@ -3318,9 +3318,10 @@ postcore_initcall(vtconsole_class_init);
> >
> > static void set_vesa_blanking(char __user *p)
> > {
> > - unsigned int mode;
> > - get_user(mode, p + 1);
> > - vesa_blank_mode = (mode < 4) ? mode : 0;
> > + unsigned int mode;
> > +
> > + if (!get_user(mode, p + 1))
> > + vesa_blank_mode = (mode < 4) ? mode : 0;
> > }
> >
> > void do_blank_screen(int entering_gfx)
>
> How about we go all the way?

It's good for us.

Thanks,

Yoichi