On 09/07/2016 12:37 PM, Arnd Bergmann wrote:
On Wednesday, September 7, 2016 11:49:59 AM CEST Laura Abbott wrote:
- if (dir & _IOC_WRITE)
- if (copy_from_user(&data, (void __user *)arg, _IOC_SIZE(cmd)))
- return -EFAULT;
+ /*
+ * The copy_from_user is unconditional here for both read and write
+ * to do the validate. If there is no write for the ioctl, the
+ * buffer is cleared
+ */
+ if (copy_from_user(&data, (void __user *)arg, _IOC_SIZE(cmd)))
+ return -EFAULT;
+
+ ret = validate_ioctl_arg(cmd, &data);
+ if (WARN_ON_ONCE(ret))
+ return ret;
I noticed that the WARN_ON_ONCE warns about invalid user input,
but I think we tend to normally just use WARN_ON for things that
go wrong inside of the kernel or in hardware.
Maybe better use printk_once() or printk_ratelimited.
Sure, the error code should hopefully be enough of a hint to
userspace to maybe check the log.
Is there any noticeable overhead in always copying the structure?
copy_from_user() can be a bit slow depending on debugging or
security features, and it seems unnecessary if the validation
is only done for one of the commands.
Good point. It made sense with some of the other ioctls (specifically
the ABI) but isn't necessary now. We can evaluate later when other
ioctls get added.
Otherwise the patch looks good to me.
Arnd
Thanks!
Laura
_______________________________________________
devel mailing list
devel@xxxxxxxxxxxxxxxxxxxxxx
http://driverdev.linuxdriverproject.org/mailman/listinfo/driverdev-devel
