On Fri, Mar 04, 2011 at 05:02:36PM -0600, Matt Mackall wrote: > copies too many bytes from userspace. Every piece of code writes its own > bound checks on copy_from_user, for instance, and gets it wrong by > hitting signed/unsigned issues, alignment issues, etc. that are on the > very edge of the average C coder's awareness. Agreed. Maybe something that would help is to have helper routines which handle the most common patterns that driver writers need. Some of the most common that I've seen from doing a quick survey are: 1) kmalloc() followed by copy_from_user() 2) kmem_cache_alloc() followed by copy_from_user() 3) copy_from_user() to a buffer allocated on the stack, where the length is passed in from userspace, and the maximum expected input size is declared by the driver. (Used by debugfs, proc, and sysfs handlers) 4) copy_from_user() to a structure allocated on the stack If we had wrappers for the most common cases, then any cases that were left that used copy_from_user() explicitly could be flagged and checked by hand, since they would be exception, and not the rule. - Ted -- To unsubscribe, send a message with 'unsubscribe linux-mm' in the body to majordomo@xxxxxxxxxx For more info on Linux MM, see: http://www.linux-mm.org/ . Fight unfair telecom internet charges in Canada: sign http://stopthemeter.ca/ Don't email: <a href=mailto:"dont@xxxxxxxxx";> email@xxxxxxxxx </a>