staging: vchiq: avoid mixing kernel and user pointers

Browse source

As found earlier, there is a problem in the create_pagelist() function
that takes a pointer argument that either points into vmalloc space or
into user space, with the pointer value controlled by user space allowing
a malicious user to trick the driver into accessing the kernel instead.

Avoid this problem by adding another function argument and passing
kernel pointers separately from user pointers. This makes it possible
to rely on sparse to point out invalid conversions, and it prevents
user space from faking a kernel pointer.

Signed-off-by: Arnd Bergmann <arnd@arndb.de>
Link: https://lore.kernel.org/r/20200925114424.2647144-2-arnd@arndb.de
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

...

This commit is contained in:

Arnd Bergmann 2020-09-25 13:43:32 +02:00 • committed by Greg Kroah-Hartman

parent 4184da4f31

commit 1c954540c0

4 changed files with 30 additions and 22 deletions

Show all changes Ignore whitespace when comparing lines Ignore changes in amount of whitespace Ignore changes in whitespace at EOL

Download patch file Download diff file Expand all files Collapse all files

22

drivers/staging/vc04_services/interface/vchiq_arm/vchiq_2835_arm.c

View file

14

drivers/staging/vc04_services/interface/vchiq_arm/vchiq_arm.c

View file

10

drivers/staging/vc04_services/interface/vchiq_arm/vchiq_core.c

View file

6

drivers/staging/vc04_services/interface/vchiq_arm/vchiq_core.h

View file