<html><body>
<p><tt>Roland Dreier <rolandd@cisco.com> wrote on 11/04/2005 04:09:39 PM:<br>
<br>
> >>>>> "Pradeep" == Pradeep Satyanarayana <pradeep@us.ibm.com> writes:<br>
> <br>
> Pradeep> Even if we change struct ib_uat_route_by_ip_req, there<br>
> Pradeep> still is user_mad.c that needs to be looked into.<br>
> <br>
> Could you be specific? As far as I can tell, all of the structures<br>
> copied to and from userspace in user_mad.c are laid out identically<br>
> for 32-bit and 64-bit architectures.</tt><br>
<br>
I looked at this from the copy_from_user() side only. I do not know which user app uses this. Here is an example of the code from ib_umad_write() that illustrates this :<br>
<br>
packet = kmalloc(sizeof *packet + IB_MGMT_RMPP_HDR, GFP_KERNEL);<br>
if (!packet)<br>
return -ENOMEM;<br>
<br>
if (copy_from_user(&packet->mad, buf,<br>
sizeof (struct ib_user_mad) + IB_MGMT_RMPP_HDR)) {<br>
ret = -EFAULT;<br>
goto err;<br>
}<br>
<br>
struct ib_umad_packet {<br>
struct ib_mad_send_buf *msg;<br>
struct list_head list;<br>
int length;<br>
struct ib_user_mad mad;<br>
};<br>
<br>
<br>
Now, sizeof *packet will be different between 32-bit and 64-bit because of the pointers. Because of this, the offset of packet->mad will be incorrect and one might find unexpected data. Would you agree?<br>
<br>
Once I saw this, I did not look further. There may be other cases of this mismatch, and I have not had a chance to take a close look at all the code. <br>
<br>
Pradeep<br>
pradeep@us.ibm.com</body></html>