Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S261950AbTELGRN (ORCPT ); Mon, 12 May 2003 02:17:13 -0400 Received: (majordomo@vger.kernel.org) by vger.kernel.org id S261953AbTELGRN (ORCPT ); Mon, 12 May 2003 02:17:13 -0400 Received: from elaine24.Stanford.EDU ([171.64.15.99]:18839 "EHLO elaine24.Stanford.EDU") by vger.kernel.org with ESMTP id S261950AbTELGRM (ORCPT ); Mon, 12 May 2003 02:17:12 -0400 Date: Sun, 11 May 2003 23:29:50 -0700 (PDT) From: Junfeng Yang To: Linux Kernel Mailing List cc: mc@cs.stanford.edu Subject: [CHECKER] 1 potential derefence of user-pointer without verification error In-Reply-To: Message-ID: MIME-Version: 1.0 Content-Type: TEXT/PLAIN; charset=US-ASCII Sender: linux-kernel-owner@vger.kernel.org X-Mailing-List: linux-kernel@vger.kernel.org Content-Length: 999 Lines: 36 Hi, Below is a warning found in pcmcia/ds.c, where user pointer is dereferenced without check. Please confirm or clarify, Thanks! -Junfeng --------------------------------------------------------- [BUG] buf is tainted implies buf.win_info.handle is tainted. pcmcia_get_mem_page dereferences its first parameter /home/junfeng/linux-tainted/drivers/pcmcia/ds.c:814:ds_ioctl: ERROR:TAINTED: 814:814:deref tainted component 'buf.win_info.handle' [struct=win_info_t.handle] [type=call] break; case DS_GET_NEXT_WINDOW: ret = pcmcia_get_next_window(&buf.win_info.handle, &buf.win_info.window); break; case DS_GET_MEM_PAGE: Error ---> ret = pcmcia_get_mem_page(buf.win_info.handle, &buf.win_info.map); break; case DS_REPLACE_CIS: - To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/