Re: [CHECKER] 4 security holes in 2.4.4-ac8

[David S. Miller]

Dawson Engler writes:
 > -------------------------------------------------------------------------------
 > [BUG] raddr seems to be a user pointer, but is written at the end of
 >       the system call.
 > 
 > ipc/shm.c: ERROR: system call 'sys_shmat' derefs non-tainted param= 3
 > 
 > asmlinkage long sys_shmat (int shmid, char *shmaddr, int shmflg, ulong *raddr)
 > {
 >         struct shmid_kernel *shp;
 > 
 > 
 > 	...
 >         *raddr = (unsigned long) user_addr;
 >         err = 0;
 >         if (IS_ERR(user_addr))
 >                 err = PTR_ERR(user_addr);
 >         return err;

Believe it or not, this one is OK :-)

All callers pass in a pointer to a local stack kernel variable
in raddr.

Later,
David S. Miller
[e-mail]