From: Andi Kleen <ak@suse.de>
To: Manfred Spraul <manfred@colorfullife.com>
Cc: Junfeng Yang <yjf@stanford.edu>, linux-kernel@vger.kernel.org
Subject: Re: [CHECKER] Help Needed!
Date: 21 Apr 2003 15:47:37 +0200 [thread overview]
Message-ID: <p7365p8x8qu.fsf@oldwotan.suse.de> (raw)
In-Reply-To: <3EA3B87B.60505@colorfullife.com.suse.lists.linux.kernel>
Manfred Spraul <manfred@colorfullife.com> writes:
> P.S.: On i386, you can access both kernel and user space after
> set_fs(KERNEL_DS), or if you use __get_user() and bypass
> access_ok(). Thus the __get_user() in arch/i386/kernel/traps.c,
> function show_registers is correct. This is the only instance I'm
> aware of where this is used, and noone else should be doing that. It
> fails on other archs, e.g. on sparc.
It is used in a couple more of places in the x86-64 architecture specific
code. Of course it is legal there too.
Also there are some corner cases; e.g. some architecture specific
code (particularly the 32bit emulations) just does access_ok or
get_user/put_user (with implied access_ok) on the first element
of a structure and then accesses the other elements with __*_user.
This works because these architectures have an unmapped hole at the
end of the user address space.
But in most other cases (in general outside arch/) it is very likely
a bug and a security hole.
-Andi
next parent reply other threads:[~2003-04-21 13:35 UTC|newest]
Thread overview: 6+ messages / expand[flat|nested] mbox.gz Atom feed top
[not found] <3EA3B87B.60505@colorfullife.com.suse.lists.linux.kernel>
2003-04-21 13:47 ` Andi Kleen [this message]
2003-04-21 15:40 ` [CHECKER] Help Needed! Manfred Spraul
2003-04-21 9:23 Manfred Spraul
2003-04-21 19:15 ` Junfeng Yang
-- strict thread matches above, loose matches on Subject: below --
2003-03-27 17:10 [CHECKER] potential dereference of user pointer errors Chris Wright
2003-04-21 7:49 ` [CHECKER] Help Needed! Junfeng Yang
2003-04-21 21:26 ` Chris Wright
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=p7365p8x8qu.fsf@oldwotan.suse.de \
--to=ak@suse.de \
--cc=linux-kernel@vger.kernel.org \
--cc=manfred@colorfullife.com \
--cc=yjf@stanford.edu \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).