Andrew Morton <akpm@xxxxxxxxxxxxxxxxxxxx> wrote:
> Is it actually known to be broken on 64-bit, or does it happen to work?
It's casting a 32-bit value to a userspace pointer and then passing that to
copy_to/from_user():
// TODO 64bit fix
if (copy_from_user
(p->virt,
(void __user *)(unsigned long)sg[i].
addr_bus, sg_size)) {
and:
// TODO 64bit fix
if (copy_to_user
((void __user *)sg[j].addr_bus, sg_list[j],
sg_size)) {
so someone's obviously aware that it is wrong. According to vc-annotate it's
been there since before Linus last reset the history, so obviously someone's
aware of it.
Another of these has in fact been cast in the way Linus objects to:
// TODO 64bit fix
if (copy_to_user
((void __user *)(u64) sg[j].addr_bus,
sg_list[j].virt, sg_size)) {
The problem, I suspect, is that userspace may have addresses that can't be
held in the 32-bit addr_bus value, but the 32-bit value is held in the
i2o_message struct:
static int i2o_cfg_passthru(unsigned long arg)
{
...
struct i2o_message *msg;
...
// TODO 64bit fix
sg = (struct sg_simple_element *)((&msg->u.head[0]) +
sg_offset);
...
}
and if these i2o_message structs are actually passed to the hardware, it may
not be possible to actually expand them, and looking at i2o_msg_post(), that
seems to be exactly what happens.
David
--
To unsubscribe from this list: send the line "unsubscribe linux-scsi" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at http://vger.kernel.org/majordomo-info.html
