[Oops 1/2]Something wrong with copy_from_user() function

[Oops 1/2]Something wrong with copy_from_user() function

[Harry Wei]

Hi us,
	When i was compiling 2.6.38.2 kernel. Something wrong happend to me.
It shows like following.

[...]
Warning: call to 'copy_from_user_overflow' declared with attribute warning:
copy_from_user buffer size is not provably correct.
[...]

See http://s1202.photobucket.com/albums/bb364/harrywei/Kernel/?action=view&current=report_bug.png for details.
	I tried to fix this warning, but i don't know how to deal with
it. Can anyone help me.

Thanks.
Harry Wei.

Re: [Oops 1/2]Something wrong with copy_from_user() function

[Andy Lutomirski]

On 04/30/2011 02:13 AM, Harry Wei wrote:
> Hi us,
> 	When i was compiling 2.6.38.2 kernel. Something wrong happend to me.
> It shows like following.
>
> [...]
> Warning: call to 'copy_from_user_overflow' declared with attribute warning:
> copy_from_user buffer size is not provably correct.
> [...]
>
> See http://s1202.photobucket.com/albums/bb364/harrywei/Kernel/?action=view&current=report_bug.png for details.
> 	I tried to fix this warning, but i don't know how to deal with
> it. Can anyone help me.

That's a bug (maybe) in drivers/staging/vt6656/wpactl.c, which is a 
staging driver and therefore liable to be imperfect.  You could ignore 
it or fix it and submit a patch.

(The bug isn't in copy_from_user -- it's an intentional warning in there 
to indicate that something might be wrong with the caller.)

--Andy

>
> Thanks.
> Harry Wei.

Re: [Oops 1/2]Something wrong with copy_from_user() function

[Jiri Kosina]

On Sat, 30 Apr 2011, Harry Wei wrote:

> Hi us,
> 	When i was compiling 2.6.38.2 kernel. Something wrong happend to me.
> It shows like following.
> 
> [...]
> Warning: call to 'copy_from_user_overflow' declared with attribute warning:
> copy_from_user buffer size is not provably correct.
> [...]
> 
> See http://s1202.photobucket.com/albums/bb364/harrywei/Kernel/?action=view&current=report_bug.png for details.
> 	I tried to fix this warning, but i don't know how to deal with
> it. Can anyone help me.

wpa_set_keys() function (from staging drivers) in your kernel uses 
copy_from_user() without proper bounds checking, and thus can overflow and 
corrupt memory.

-- 
Jiri Kosina
SUSE Labs, Novell Inc.

Re: [Oops 1/2]Something wrong with copy_from_user() function

[Harry Wei]

On Sat, Apr 30, 2011 at 11:13:10PM +0200, Jiri Kosina wrote:
> On Sat, 30 Apr 2011, Harry Wei wrote:
> 
> 
> wpa_set_keys() function (from staging drivers) in your kernel uses 
> copy_from_user() without proper bounds checking, and thus can overflow and 
> corrupt memory.
Hmmm, i see.

Thanks.
Harry Wei.
> 

Re: [Oops 1/2]Something wrong with copy_from_user() function

[Greg KH]

On Sun, May 01, 2011 at 09:21:30AM +0800, Harry Wei wrote:
> On Sat, Apr 30, 2011 at 11:13:10PM +0200, Jiri Kosina wrote:
> > On Sat, 30 Apr 2011, Harry Wei wrote:
> > 
> > 
> > wpa_set_keys() function (from staging drivers) in your kernel uses 
> > copy_from_user() without proper bounds checking, and thus can overflow and 
> > corrupt memory.
> Hmmm, i see.

Patches gladly welcome to fix this :)