diff options
| author |   Arnd Bergmann <arnd@arndb.de> | 2020-09-25 13:43:32 +0200 |
|---|---|---|
| committer |   Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 2020-09-25 14:34:03 +0200 |
| commit | 1c954540c0eb420dfbaefe779cf23fb82759809a (patch) | |
| tree | 8492239c948634431ddaab8e609232b434b96089 /drivers/staging/vc04_services/interface/vchiq_arm/vchiq_core.h | |
| parent | staging: vchiq: fix __user annotations (diff) | |
| download | linux-dev-1c954540c0eb420dfbaefe779cf23fb82759809a.tar.xz linux-dev-1c954540c0eb420dfbaefe779cf23fb82759809a.zip | |
staging: vchiq: avoid mixing kernel and user pointers
As found earlier, there is a problem in the create_pagelist() function
that takes a pointer argument that either points into vmalloc space or
into user space, with the pointer value controlled by user space allowing
a malicious user to trick the driver into accessing the kernel instead.
Avoid this problem by adding another function argument and passing
kernel pointers separately from user pointers. This makes it possible
to rely on sparse to point out invalid conversions, and it prevents
user space from faking a kernel pointer.
Signed-off-by: Arnd Bergmann <arnd@arndb.de>
Link: https://lore.kernel.org/r/20200925114424.2647144-2-arnd@arndb.de
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Diffstat (limited to 'drivers/staging/vc04_services/interface/vchiq_arm/vchiq_core.h')
| -rw-r--r-- | drivers/staging/vc04_services/interface/vchiq_arm/vchiq_core.h | 6 |
1 files changed, 3 insertions, 3 deletions
diff --git a/drivers/staging/vc04_services/interface/vchiq_arm/vchiq_core.h b/drivers/staging/vc04_services/interface/vchiq_arm/vchiq_core.h index 5ec717969676..06200a76b871 100644 --- a/drivers/staging/vc04_services/interface/vchiq_arm/vchiq_core.h +++ b/drivers/staging/vc04_services/interface/vchiq_arm/vchiq_core.h @@ -559,8 +559,8 @@ extern void remote_event_pollall(struct vchiq_state *state); extern enum vchiq_status -vchiq_bulk_transfer(unsigned int handle, void *offset, int size, - void *userdata, enum vchiq_bulk_mode mode, +vchiq_bulk_transfer(unsigned int handle, void *offset, void __user *uoffset, + int size, void *userdata, enum vchiq_bulk_mode mode, enum vchiq_bulk_dir dir); extern int @@ -633,7 +633,7 @@ vchiq_queue_message(unsigned int handle, extern enum vchiq_status vchiq_prepare_bulk_data(struct vchiq_bulk *bulk, void *offset, - int size, int dir); + void __user *uoffset, int size, int dir); extern void vchiq_complete_bulk(struct vchiq_bulk *bulk); |