Re: AUDIT of 2.5.15 copy_to/from_user

[Alan Cox]

> > > __copy_to/from_user() --> the same as above, but can they actually return 
> > > anything other than 0? My assembler is no good and I'm not able to see if
> > 
> > They do the same things, but don't do any initial range checks that might
> > be done by access_ok before hand
> 
> On the emu10k1 driver we use access_ok(VERIFY_READ) once at the beginning
> of the write() routine to check we can access the user buffer. After that 
> we always use __copy_from_user() and we trust it not to fail. Is this 
> correct, or not?

This is correct

> Basically, where in copy_from_user() is it determined the function cannot
> copy the entire user buffer? Is it in access_ok() only or also in 
> __constant_copy_user_zeroing()?

Static once off checks are done in access_ok
Dynamic checks are doing in __copy_from_*

Which are which depends on the platform. On x86 for example access_ok
is basically a check for 0->0xBFFFFFFF range and no more