PATCH: 2.6.7-rc3 drivers/video/fbmem.c: user/kernel pointer bugs
From: Robert T. Johnson <hidden>
Date: 2004-06-09 22:46:58
Also in:
lkml
Since sprite is a user pointer, reading sprite->mask or sprite->image.data requires unsafe dereferences. Let me know if you have any questions or if I've made a mistake. Best, Rob
--- linux-2.6.7-rc3-full/drivers/video/fbmem.c.orig Wed Jun 9 13:09:30 2004
+++ linux-2.6.7-rc3-full/drivers/video/fbmem.c Wed Jun 9 13:07:06 2004@@ -901,7 +901,9 @@ fb_cursor(struct fb_info *info, struct f { struct fb_cursor cursor; int err; - + char *mask; + const char *image_data; + if (copy_from_user(&cursor, sprite, sizeof(struct fb_cursor))) return -EFAULT;
@@ -920,18 +922,20 @@ fb_cursor(struct fb_info *info, struct f (cursor.image.width != info->cursor.image.width)) cursor.set |= FB_CUR_SETSIZE; + image_data = cursor.image.data; cursor.image.data = kmalloc(size, GFP_KERNEL); if (!cursor.image.data) return -ENOMEM; + mask = cursor.mask; cursor.mask = kmalloc(size, GFP_KERNEL); if (!cursor.mask) { kfree(cursor.image.data); return -ENOMEM; } - if (copy_from_user(cursor.image.data, sprite->image.data, size) || - copy_from_user(cursor.mask, sprite->mask, size)) { + if (copy_from_user(cursor.image.data, image_data, size) || + copy_from_user(cursor.mask, mask, size)) { kfree(cursor.image.data); kfree(cursor.mask); return -EFAULT;