Re: [PATCH] drivers/char/mem.c: Add /dev/ioports, supporting 16-bit and 32-bit ports
From: Jann Horn <hidden>
Date: 2014-05-11 12:50:17
Also in:
lkml
On Sat, May 10, 2014 at 12:32:46PM -0700, Josh Triplett wrote:
On Sat, May 10, 2014 at 09:07:42AM +0200, Jann Horn wrote:quoted
On Fri, May 09, 2014 at 12:19:16PM -0700, Josh Triplett wrote:quoted
+ if (port > 65535) + return 0; + switch (count) {[...]quoted
+ case 4: + if (__put_user(inl(port), buf) < 0) + return -EFAULT;What if I attempt a four-byte read at 65535? That would access four out-of-bounds bytes, right?No, it would do an ind instruction on port 65535.
Yes, on x86. What about other architectures? http://lxr.free-electrons.com/source/arch/m68k/include/asm/io_mm.h#L110 110 #define inl mcf_pci_inl http://lxr.free-electrons.com/source/arch/m68k/platform/coldfire/pci.c#L163 163 u32 mcf_pci_inl(u32 addr) 164 { 165 return le32_to_cpu(__raw_readl(iospace + (addr & PCI_IO_MASK))); 166 } http://lxr.free-electrons.com/source/arch/m68k/platform/coldfire/pci.c#L37 37 #define PCI_IO_SIZE 0x00010000 /* 64k */ 38 #define PCI_IO_MASK (PCI_IO_SIZE - 1) http://lxr.free-electrons.com/source/arch/m68k/include/asm/raw_io.h#L54 54 #define __raw_readl in_be32 http://lxr.free-electrons.com/source/arch/m68k/include/asm/raw_io.h#L36 36 #define in_be32(addr) \ 37 ({ u32 __v = (*(__force volatile u32 *) (addr)); __v; }) As far as I can see, you'd get a slightly out-of-bounds read here. Or is that feature only intended for x86?
Attachments
- signature.asc [application/pgp-signature] 836 bytes