Messages in this thread | | | Subject | Re: [Coverity] Untrusted user data in kernel | From | Alan Cox <> | Date | Thu, 06 Jan 2005 16:29:30 +0000 |
| |
> The SDLA_CLEAR ioctl (the sdla_clear(dev) function) tries > to clear exactly 65536 bytes (hardcoded at sdla.c:sdla_clear() line 140). > So the mem.len should be <= 65536 bytes, and even mem.addr + mem.len > should be <= 65536 bytes. > > So I propose the following patch (maybe the constant 65536 should > be defined in sdla.h and used both in sdla_xfer() and sdla_clear()):
I'd propose they are set to CAP_SYS_RAWIO for those specific debugging/firmware load operations. They allow access to that level potentially anyway. That solves the problem cleanly.
- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/
| |