Thread (8 messages) flat view 8 messages, 4 authors, 2018-06-25

Re: [PATCH] ipv6: avoid copy_from_user() via ipv6_renew_options_kern()

From: David Miller <davem@davemloft.net>
Date: 2018-06-23 01:57:09
Also in: linux-security-module, selinux

From: Paul Moore <redacted>
Date: Fri, 22 Jun 2018 17:18:20 -0400
-	const mm_segment_t old_fs = get_fs();
-
-	set_fs(KERNEL_DS);
-	ret_val = ipv6_renew_options(sk, opt, newtype,
-				     (struct ipv6_opt_hdr __user *)newopt,
-				     newoptlen);
-	set_fs(old_fs);
So is it really the case that the traditional construct:

	set_fs(KERNEL_DS);
	... copy_{from,to}_user(...);
	set_fs(old_fs);

is no longer allowed?

Setting fs to KERNEL_DS is supposed to make user copies work on kernel
memory.  Or at least it did for 20+ years :-)
Keyboard shortcuts
hback out one level
jnext message in thread
kprevious message in thread
ldrill in
Escclose help / fold thread tree
?toggle this help