3 ms·

I have not ready anything about this bug, other than the very short description in the linked blog, however this seems like a bug that would have been flagged b

I have not ready anything about this bug, other than the very short description in the linked blog, however this seems like a bug that would have been flagged by a static analysis tool. I know they've been used on the kernel (e.g. Coverity) Very surprised it survived until now.

benmmurphy 9y ago
the syscall function takes a void* parameter then does a copy from user space into the kernel using the wrong target type/sizeof. i think it works because the incorrect type was a superset of the correct type. i don't think any static analyser could catch this. proposed patch here: https://bugzilla.kernel.org/attachment.cgi?id=256997&action=diff https://bugzilla.kernel.org/attachment.cgi?id=256997&action=...
- jjnoakes 9y ago
  A static analyzer with sufficient inter-procedural analysis (i.e. across the user/kernel boundary) could certainly see the type of the allocated structure in userspace, and flag the kernel read of a larger type.