From 0596de57042e704b9d2f7ef1904d31d63ba3acf9 Mon Sep 17 00:00:00 2001 From: Vyacheslav Cherkashin Date: Tue, 29 Oct 2013 17:38:30 +0400 Subject: [PATCH] [IMPROVE] safe read stack Change-Id: Ia80787a2a0e6221ac887ec419535a19f28021491 Signed-off-by: Vyacheslav Cherkashin --- writer/kernel_operations.c | 16 ++++++++++++---- 1 file changed, 12 insertions(+), 4 deletions(-) diff --git a/writer/kernel_operations.c b/writer/kernel_operations.c index 76b1eca..d69fe74 100644 --- a/writer/kernel_operations.c +++ b/writer/kernel_operations.c @@ -24,6 +24,8 @@ */ #include +#include +#include #if defined(CONFIG_ARM) @@ -49,8 +51,11 @@ int get_args(unsigned long args[], int cnt, struct pt_regs *regs) /* Get other args from stack */ for (i = stack_args; i < cnt; ++i) { - unsigned long *args_in_sp = (unsigned long *)regs->ARM_sp; - args[i] = args_in_sp[i - stack_args]; + unsigned long *args_in_sp = (unsigned long *)regs->ARM_sp + + i - stack_args; + if (get_user(args[i], args_in_sp)) + printk("failed to dereference a pointer, addr=%p\n", + args_in_sp); } return 0; @@ -88,8 +93,11 @@ int get_args(unsigned long args[], int cnt, struct pt_regs *regs) /* Get other args from stack */ for (i = stack_args; i < cnt; ++i) { - unsigned long *args_in_sp = (unsigned long *)regs->sp + 1; - args[i] = args_in_sp[i - stack_args]; + unsigned long *args_in_sp = (unsigned long *)regs->sp + + 1 + i - stack_args; + if (get_user(args[i], args_in_sp)) + printk("failed to dereference a pointer, addr=%p\n", + args_in_sp); } return 0; -- 2.7.4