On Thu, Mar 30, 2017 at 12:10 PM, Al Viro <viro@xxxxxxxxxxxxxxxxxx> wrote:
>
> That they very definitely should not. And not because of access_ok() or
> might_fault() - this is one place where zero-padding is absolutely wrong.
> So unless you are going to take it out of copy_from_user() and pray
> that random shit ioctls in random shit drivers check the return value
> properly, copy_from_user() is no-go here.
Actually, that is a great example of why you should *not* use
__copy_from_user().
If the reason is lack of zero-padding, that doesn't mean that suddenly
we shouldn't check the range. And it doesn't mean that it shouldn't
document why it does it.
So dammit, just add something like this to lib/iovec.c:
static inline unsigned long copy_from_user_nozero(void *to, const
void __user *from, size_t len)
{
if (!access_ok(from, len))
return len;
return __copy_from_user(to, from, len);
}
which now isn't insecure, and also magically documents *why* you don't
just use the plain copy_from_user().
Linus
