From: Jean Delvare <khali@linux-fr.org>
To: "Robert T. Johnson" <rtjohnso@eecs.berkeley.edu>,
"Greg KH" <greg@kroah.com>
Cc: sensors@stimpy.netroedge.com, linux-kernel@vger.kernel.org
Subject: Re: PATCH: 2.4.22-pre7 drivers/i2c/i2c-dev.c user/kernel bug and mem leak
Date: Sun, 3 Aug 2003 19:23:12 +0200 [thread overview]
Message-ID: <20030803192312.68762d3c.khali@linux-fr.org> (raw)
Hi all,
Ten days ago, Robert T. Johnson repported two bugs in 2.4's
drivers/i2c/i2c-dev.c. It also applies to i2c CVS (out of kernel), which
is intended to become 2.4's soon. Being a member of the LM Sensors dev
team, I took a look at the repport. My knowledge is somewhat limited but
I'll do my best to help (unless Greg wants to handle it alone? ;-)).
For the user/kernel bug, I'm not sure I understand how copy_from_user is
supposed to work. If I understand what the proposed patch does, it
simply allocates a second buffer, copy_from_user to that buffer instead
of to the original one, and then copies from that second buffer to the
original one (kernel to kernel). I just don't see how different it is
from what the current code does, as far as user/kernel issues are
concerned. I must be missing something obvious, can someone please bring
me some light?
For the mem leak bug, it's clearly there. I admit the proposed patch
fixes it, but I think there is a better way to fix it. Compare what the
proposed patch does:
--- i2c-dev.c Sun Aug 3 18:24:33 2003
+++ i2c-dev.c.proposed Sun Aug 3 19:13:58 2003
@@ -226,6 +226,7 @@
res = 0;
for( i=0; i<rdwr_arg.nmsgs; i++ )
{
+ rdwr_pa[i].buf = NULL;
if(copy_from_user(&(rdwr_pa[i]),
&(rdwr_arg.msgs[i]),
sizeof(rdwr_pa[i])))
@@ -254,8 +255,9 @@
}
if (res < 0) {
int j;
- for (j = 0; j < i; ++j)
- kfree(rdwr_pa[j].buf);
+ for (j = 0; j <= i; ++j)
+ if (rdwr_pa[j].buf)
+ kfree(rdwr_pa[j].buf);
kfree(rdwr_pa);
return res;
}
with what I suggest:
--- i2c-dev.c Sun Aug 3 18:24:33 2003
+++ i2c-dev.c.khali Sun Aug 3 19:15:04 2003
@@ -247,8 +247,9 @@
if(copy_from_user(rdwr_pa[i].buf,
rdwr_arg.msgs[i].buf,
rdwr_pa[i].len))
{
+ kfree(rdwr_pa[i].buf);
res = -EFAULT;
break;
}
}
Contrary to the proposed fix, my fix does not slow down the non-faulty
cases. I also believe it will increase the code size by fewer bytes than
the proposed fix (not verified though).
So, what about it?
PS: I really would like to see Frodo Looijaard's address replaced with
the LM Sensors mailing list address <sensors@stimpy.netroedge.com> as
the main I2C contact in MAINTAINERS. Simon Vogl and Frodo Looijaard's
have been doing a really great job, but they do not work actively on I2C
anymore, so they end up forwarding every repport to the list anyway.
--
Jean Delvare
http://www.ensicaen.ismra.fr/~delvare/
next reply other threads:[~2003-08-03 17:23 UTC|newest]
Thread overview: 18+ messages / expand[flat|nested] mbox.gz Atom feed top
2003-08-03 17:23 Jean Delvare [this message]
2003-08-04 15:32 ` PATCH: 2.4.22-pre7 drivers/i2c/i2c-dev.c user/kernel bug and mem leak Sergey Vlasov
2003-08-05 8:32 ` Jean Delvare
2003-08-05 14:10 ` Sergey Vlasov
2003-08-05 21:07 ` Greg KH
2003-08-06 8:07 ` [PATCH 2.4] i2c-dev " Jean Delvare
[not found] ` <1060886657.1006.7121.camel@dooby.cs.berkeley.edu>
[not found] ` <20030814190954.GA2492@kroah.com>
2003-08-15 2:01 ` Robert T. Johnson
2003-08-15 21:13 ` Greg KH
2003-08-15 22:17 ` Robert T. Johnson
2003-08-15 23:51 ` Greg KH
2003-08-18 0:54 ` Robert T. Johnson
2003-08-18 21:05 ` Greg KH
2003-09-10 23:02 ` CQual 0.99 Released: user/kernel pointer bug finding tool Robert T. Johnson
2003-08-28 1:17 ` [PATCH 2.4] i2c-dev user/kernel bug and mem leak Robert T. Johnson
2003-08-29 16:21 ` Jean Delvare
2003-08-29 17:30 ` Robert T. Johnson
-- strict thread matches above, loose matches on Subject: below --
2003-07-23 20:58 PATCH: 2.4.22-pre7 drivers/i2c/i2c-dev.c " Robert T. Johnson
2003-07-24 14:05 ` Greg KH
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20030803192312.68762d3c.khali@linux-fr.org \
--to=khali@linux-fr.org \
--cc=greg@kroah.com \
--cc=linux-kernel@vger.kernel.org \
--cc=rtjohnso@eecs.berkeley.edu \
--cc=sensors@stimpy.netroedge.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).