| Message ID | 20200519004531.33158-1-tasman@leaflabs.com (mailing list archive) |
|---|---|
| State | Mainlined |
| Commit | 728774f7801629226a0c7bd9f9af6ff1dfcb5ca5 |
| Headers | show |
| Series | staging: vchiq_arm: cast with __force as needed | expand |
On Mon, May 18, 2020 at 08:45:31PM -0400, Mitchell Tasman wrote: > In several cases where a pointer marked as __user is > (intentionally) assigned or passed to a non-marked target, > cast to the target pointer type with a __force directive > to quiet warnings from sparse. > > Signed-off-by: Mitchell Tasman <tasman@leaflabs.com> > --- > .../vc04_services/interface/vchiq_arm/vchiq_2835_arm.c | 7 ++++--- > .../staging/vc04_services/interface/vchiq_arm/vchiq_arm.c | 4 +++- > 2 files changed, 7 insertions(+), 4 deletions(-) > > diff --git a/drivers/staging/vc04_services/interface/vchiq_arm/vchiq_2835_arm.c b/drivers/staging/vc04_services/interface/vchiq_arm/vchiq_2835_arm.c > index c18c6ca0b6c0..38a13e4618a8 100644 > --- a/drivers/staging/vc04_services/interface/vchiq_arm/vchiq_2835_arm.c > +++ b/drivers/staging/vc04_services/interface/vchiq_arm/vchiq_2835_arm.c > @@ -371,14 +371,15 @@ create_pagelist(char __user *buf, size_t count, unsigned short type) > pagelistinfo->scatterlist = scatterlist; > pagelistinfo->scatterlist_mapped = 0; > > - if (is_vmalloc_addr(buf)) { > + if (is_vmalloc_addr((void __force *)buf)) { Am I reading this correctly??? This is actually a user controlled pointer that comes from the vchiq_ioctl() when we do VCHIQ_IOC_QUEUE_BULK_TRANSMIT/RECEIVE. So we take random pointer from user space and if it happens to point to kernel space then we trust it and presumably start BULK_TRANSMITing data to it??? LOL.... This doesn't seem safe at all. regards, dan carpenter
On 5/22/20 7:06 AM, Dan Carpenter wrote: > On Mon, May 18, 2020 at 08:45:31PM -0400, Mitchell Tasman wrote: >> In several cases where a pointer marked as __user is >> (intentionally) assigned or passed to a non-marked target, >> cast to the target pointer type with a __force directive >> to quiet warnings from sparse. >> >> Signed-off-by: Mitchell Tasman <tasman@leaflabs.com> >> --- >> .../vc04_services/interface/vchiq_arm/vchiq_2835_arm.c | 7 ++++--- >> .../staging/vc04_services/interface/vchiq_arm/vchiq_arm.c | 4 +++- >> 2 files changed, 7 insertions(+), 4 deletions(-) >> >> diff --git a/drivers/staging/vc04_services/interface/vchiq_arm/vchiq_2835_arm.c b/drivers/staging/vc04_services/interface/vchiq_arm/vchiq_2835_arm.c >> index c18c6ca0b6c0..38a13e4618a8 100644 >> --- a/drivers/staging/vc04_services/interface/vchiq_arm/vchiq_2835_arm.c >> +++ b/drivers/staging/vc04_services/interface/vchiq_arm/vchiq_2835_arm.c >> @@ -371,14 +371,15 @@ create_pagelist(char __user *buf, size_t count, unsigned short type) >> pagelistinfo->scatterlist = scatterlist; >> pagelistinfo->scatterlist_mapped = 0; >> >> - if (is_vmalloc_addr(buf)) { >> + if (is_vmalloc_addr((void __force *)buf)) { > > Am I reading this correctly??? > > This is actually a user controlled pointer that comes from the > vchiq_ioctl() when we do VCHIQ_IOC_QUEUE_BULK_TRANSMIT/RECEIVE. So we > take random pointer from user space and if it happens to point to kernel > space then we trust it and presumably start BULK_TRANSMITing data to > it??? > > LOL.... This doesn't seem safe at all. Is additional validation of buf and its extent necessary and sufficient, e.g. perhaps access_ok(buf, count * PAGE_SIZE) somewhere along the call chain? Or does vhciq_arm need to take a different approach in the area that Dan Carpenter flagged? Thank you. > > regards, > dan carpenter > Regards, Mitch
diff --git a/drivers/staging/vc04_services/interface/vchiq_arm/vchiq_2835_arm.c b/drivers/staging/vc04_services/interface/vchiq_arm/vchiq_2835_arm.c index c18c6ca0b6c0..38a13e4618a8 100644 --- a/drivers/staging/vc04_services/interface/vchiq_arm/vchiq_2835_arm.c +++ b/drivers/staging/vc04_services/interface/vchiq_arm/vchiq_2835_arm.c @@ -371,14 +371,15 @@ create_pagelist(char __user *buf, size_t count, unsigned short type) pagelistinfo->scatterlist = scatterlist; pagelistinfo->scatterlist_mapped = 0; - if (is_vmalloc_addr(buf)) { + if (is_vmalloc_addr((void __force *)buf)) { unsigned long length = count; unsigned int off = offset; for (actual_pages = 0; actual_pages < num_pages; actual_pages++) { - struct page *pg = vmalloc_to_page(buf + (actual_pages * - PAGE_SIZE)); + struct page *pg = + vmalloc_to_page((void __force *)(buf + + (actual_pages * PAGE_SIZE))); size_t bytes = PAGE_SIZE - off; if (!pg) { diff --git a/drivers/staging/vc04_services/interface/vchiq_arm/vchiq_arm.c b/drivers/staging/vc04_services/interface/vchiq_arm/vchiq_arm.c index 2d3e114f4a66..28ea8c3a4cba 100644 --- a/drivers/staging/vc04_services/interface/vchiq_arm/vchiq_arm.c +++ b/drivers/staging/vc04_services/interface/vchiq_arm/vchiq_arm.c @@ -1209,7 +1209,9 @@ vchiq_ioctl(struct file *file, unsigned int cmd, unsigned long arg) /* The completion must point to the ** msgbuf. */ - completion->header = msgbuf; + completion->header = + (struct vchiq_header __force *) + msgbuf; } if ((completion->reason ==
In several cases where a pointer marked as __user is (intentionally) assigned or passed to a non-marked target, cast to the target pointer type with a __force directive to quiet warnings from sparse. Signed-off-by: Mitchell Tasman <tasman@leaflabs.com> --- .../vc04_services/interface/vchiq_arm/vchiq_2835_arm.c | 7 ++++--- .../staging/vc04_services/interface/vchiq_arm/vchiq_arm.c | 4 +++- 2 files changed, 7 insertions(+), 4 deletions(-)