Kernel Newbies archive on lore.kernel.org
 help / color / Atom feed
From: Richard Sailer <richard_siegfried@systemli.org>
To: kernelnewbies <Kernelnewbies@kernelnewbies.org>
Subject: Dubios pointer casting with put_user()
Date: Fri, 17 Jul 2020 02:13:34 +0200
Message-ID: <d8a96eaf-3cbf-a088-5dd5-ad8b64ec9749@systemli.org> (raw)

[-- Attachment #1.1.1: Type: text/plain, Size: 803 bytes --]

Hi,

In the following example from net/dccp/proto.c the pointer given
put_user() is casted to (int __user *) although the value to copy is a
unsigned long. Is this (correctness and security wise) sane? Because as
I understand it put_user() determines the amount it copies from the
pointer type.

```
		unsigned long amount = 0;

		skb = skb_peek(&sk->sk_receive_queue);
		if (skb != NULL) {
			amount = skb->len;
		}
		rc = put_user(amount, (int __user *)arg);
```

Also skb->len is an unsigned int realisticly in most cases < 9000 (and
in all cases I can imagine < int_max (with 16 bit)).

I would like to declare amount as int outside of the switch case
statement (because I  need it in another case statement as signed int)
would it be safe to do so?

Thanks,
-- Richard


[-- Attachment #1.2: OpenPGP digital signature --]
[-- Type: application/pgp-signature, Size: 488 bytes --]

[-- Attachment #2: Type: text/plain, Size: 170 bytes --]

_______________________________________________
Kernelnewbies mailing list
Kernelnewbies@kernelnewbies.org
https://lists.kernelnewbies.org/mailman/listinfo/kernelnewbies

             reply index

Thread overview: 5+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2020-07-17  0:13 Richard Sailer [this message]
2020-07-17  0:19 ` Richard Sailer
2020-07-17 22:46 ` Valdis Klētnieks
2020-07-19 12:15   ` Richard Sailer
2020-07-19 22:50     ` Valdis Klētnieks

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=d8a96eaf-3cbf-a088-5dd5-ad8b64ec9749@systemli.org \
    --to=richard_siegfried@systemli.org \
    --cc=Kernelnewbies@kernelnewbies.org \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link

Kernel Newbies archive on lore.kernel.org

Archives are clonable:
	git clone --mirror https://lore.kernel.org/kernelnewbies/0 kernelnewbies/git/0.git

	# If you have public-inbox 1.1+ installed, you may
	# initialize and index your mirror using the following commands:
	public-inbox-init -V2 kernelnewbies kernelnewbies/ https://lore.kernel.org/kernelnewbies \
		kernelnewbies@kernelnewbies.org
	public-inbox-index kernelnewbies

Example config snippet for mirrors

Newsgroup available over NNTP:
	nntp://nntp.lore.kernel.org/org.kernelnewbies.kernelnewbies


AGPL code for this site: git clone https://public-inbox.org/public-inbox.git