<br><br>发自我的华为手机<html><head><meta http-equiv="Content-Type" content="text/html; charset=UTF-8"></head><body><div class="quote" style="line-height: 1.5"><br></div><div class="quote" style="line-height: 1.5">i have see copy user pointer to a kernel temp struct before call i915_gem_pead_ioctl </div><div class="quote" style="line-height: 1.5">thanks for your reply</div><div class="quote" style="line-height: 1.5"><br>-------- 原始邮件 --------<br>主题：Re: Linux kernel: drivers/gpu/drm/i915/i915_gem.c: i915_gem_pread_ioctl similar Double-Fetch bug<br>发件人：Jani Nikula <jani.nikula@linux.intel.com><br>收件人：sohu0106 <sohu0106@126.com>,joonas.lahtinen@linux.intel.com,rodrigo.vivi@intel.com<br>抄送：intel-gfx@lists.freedesktop.org<br><br><br type="attribution"><blockquote class="quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">On Sat, 16 Dec 2017, sohu0106 <sohu0106@126.com> wrote:<br>> I found a similar Double-Fetch bug in drivers/gpu/drm/i915/i915_gem.c<br>> when I was examining the source code. <br><br>Similar to what?<br><br>> In function i915_gem_pread_ioctl(), the driver check user space data<br>> by pointer data_ptr via access_ok() in line 694, and after run a<br>> while, in function shmem_pread_slow in line 657 or shmem_pread_fast in<br>> line 639, finally it use __copy_to_user with no check user space<br>> pointer.<br>><br>> If the args->data_ptr is modified by a user thread under race<br>> condition between the check and __copy_to_user operations, for example<br>> changing to a kernel address, this will lead to Arbitrary kernel<br>> address writing(caused by __copy_to_user() ).<br><br>See drm_ioctl() for why this is not a possible scenario.<br><br>BR,<br>Jani.<br><br>-- <br>Jani Nikula, Intel Open Source Technology Center<br></sohu0106@126.com></blockquote></sohu0106@126.com></jani.nikula@linux.intel.com></div></body></html>