Skip to contentSkip to conversation

PATCH: 2.6.7-rc3 drivers/char/ipmi/ipmi_devintf.c: user/kernel pointer typo

PATCH Robert T. Johnson 3 participants 3 messages Jun 9, 2004 – Jun 15, 2004 IPMI

lore
Share & tools
lore

Robert T. Johnson

author
#0 lore raw

Judging from context, I think there's a misplaced "&" in this code that can cause stack overflows and other nasty problems. Perhaps it's left over from when msgdata was an array instead of a pointer? Let me know if you have any questions or I made a mistake.

Best,
Rob

drivers/char/ipmi/ipmi_devintf.c renamed from drivers/char/ipmi/ipmi_devintf.c.orig +1 -1
@@ -199,7 +199,7 @@ static int handle_send_req(ipmi_user_t  
 			goto out;
 		}
 
-		if (copy_from_user(&msgdata,
+		if (copy_from_user(msgdata,
 				   req->msg.data,
 				   req->msg.data_len))
 		{
#1 lore raw
Quoted 4 lines · Robert T. Johnson

Judging from context, I think there's a misplaced "&" in this code that can cause stack overflows and other nasty problems. Perhaps it's left over from when msgdata was an array instead of a pointer? Let me know if you have any questions or I made a mistake.

ACK.

#2 lore raw
In reply to Robert T. Johnson

You are obviously right, and it looks like the fix is in the newest release candidate. Thanks for finding this.

-Corey

Quoted 23 lines · Robert T. Johnson

Judging from context, I think there's a misplaced "&" in this code that
can cause stack overflows and other nasty problems. Perhaps it's left over from when msgdata was an array instead of a pointer? Let me know if you have any questions or I made a mistake.

Best,
Rob

drivers/char/ipmi/ipmi_devintf.c renamed from drivers/char/ipmi/ipmi_devintf.c.orig +1 -1
@@ -199,7 +199,7 @@ static int handle_send_req(ipmi_user_t  
 			goto out;
 		}
 
-		if (copy_from_user(&msgdata,
+		if (copy_from_user(msgdata,
 				   req->msg.data,
 				   req->msg.data_len))
 		{