Skip to contentSkip to conversation

tty/serial: fix invalid user-pointer checks

PATCH In review Johan Hovold 2 participants 5 messages Nov 8, 2016 TTY layer and serial drivers

lore
Share & tools
lore
#0 lore raw

cover tty/serial: fix invalid user-pointer checks

This series drop invalid user-pointer checks from ioctl handlers (which tend to get replicated in new drivers).

Note that only the rocket driver has been compile tested.

Johan

Johan Hovold (3):
tty: amiserial: fix invalid user-pointer check
tty: rocket: fix invalid user-pointer checks
serial: crisv10: fix invalid user-pointer check

 drivers/tty/amiserial.c      | 2 --
 drivers/tty/rocket.c         | 4 ----
 drivers/tty/serial/crisv10.c | 2 --
 3 files changed, 8 deletions(-)
Signature · 1 line
2.7.3
#1 lore raw

PATCH 1/3 tty: amiserial: fix invalid user-pointer check

Drop invalid user-pointer check from TIOCGSERIAL handler.

A NULL-pointer can be valid in user space and copy_to_user() takes care of sanity checking.

---
 drivers/tty/amiserial.c | 2 --
 1 file changed, 2 deletions(-)
drivers/tty/amiserial.c +0 -2
index 208f573495dc..dfbb974927f2 100644
@@ -1012,8 +1012,6 @@ static int get_serial_info(struct tty_struct *tty, struct serial_state *state,
 {
 	struct serial_struct tmp;
    
-	if (!retinfo)
-		return -EFAULT;
 	memset(&tmp, 0, sizeof(tmp));
 	tty_lock(tty);
 	tmp.line = tty->index;
Signature · 1 line
2.7.3
#2 lore raw

PATCH 2/3 tty: rocket: fix invalid user-pointer checks

In reply to Johan Hovold

Drop invalid user-pointer checks from custom ioctl handlers.

A NULL-pointer can be valid in user space and copy_to_user() takes care of sanity checking.

---
 drivers/tty/rocket.c | 4 ----
 1 file changed, 4 deletions(-)
drivers/tty/rocket.c +0 -4
index b0cc47c77b40..d66c1edd9892 100644
@@ -1189,8 +1189,6 @@ static int get_config(struct r_port *info, struct rocket_config __user *retinfo)
 {
 	struct rocket_config tmp;
 
-	if (!retinfo)
-		return -EFAULT;
 	memset(&tmp, 0, sizeof (tmp));
 	mutex_lock(&info->port.mutex);
 	tmp.line = info->line;
@@ -1255,8 +1253,6 @@ static int get_ports(struct r_port *info, struct rocket_ports __user *retports)
 	struct rocket_ports tmp;
 	int board;
 
-	if (!retports)
-		return -EFAULT;
 	memset(&tmp, 0, sizeof (tmp));
 	tmp.tty_major = rocket_driver->major;
 
Signature · 1 line
2.7.3
#3 lore raw

PATCH 3/3 serial: crisv10: fix invalid user-pointer check

In reply to Johan Hovold

Drop invalid user-pointer check from TIOCGSERIAL handler.

A NULL-pointer can be valid in user space and copy_to_user() takes care of sanity checking.

---
 drivers/tty/serial/crisv10.c | 2 --
 1 file changed, 2 deletions(-)
drivers/tty/serial/crisv10.c +0 -2
index 315c84979b18..d4cb6ff52e7a 100644
@@ -3214,8 +3214,6 @@ get_serial_info(struct e100_serial * info,
 	 * should set them to something else than 0.
 	 */
 
-	if (!retinfo)
-		return -EFAULT;
 	memset(&tmp, 0, sizeof(tmp));
 	tmp.type = info->type;
 	tmp.line = info->line;
Signature · 1 line
2.7.3
Acked-by on v1 3/3
#4 lore raw

Re: [PATCH 3/3] serial: crisv10: fix invalid user-pointer check

Quoted 6 lines · Johan Hovold

Drop invalid user-pointer check from TIOCGSERIAL handler.

A NULL-pointer can be valid in user space and copy_to_user() takes care of sanity checking.

Cc Mikael Starvik <[email protected]>
Quoted 2 lines

/^JN - Jesper Nilsson

Signature · 1 line
               Jesper Nilsson -- [email protected]