Skip to content

Commit

Permalink
itimer: Schedule silent NULL pointer fixup in setitimer() for removal
Browse files Browse the repository at this point in the history
setitimer() should return -EFAULT if called with an invalid pointer
for value. The current code excludes a NULL pointer from this rule and
silently uses it to stop the timer. This violates the spec.

Warn about user space apps which rely on that feature and schedule it
for removal.

[ tglx: Massaged changelog, warn message and Doc entry ]

Signed-off-by: Sasikantha babu <sasikanth.v19@gmail.com>
Link: http://lkml.kernel.org/r/1332340854-26053-1-git-send-email-sasikanth.v19@gmail.com
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
  • Loading branch information
Sasikantha babu authored and Thomas Gleixner committed Mar 30, 2012
1 parent f52b69f commit aa2bf9b
Show file tree
Hide file tree
Showing 2 changed files with 12 additions and 1 deletion.
8 changes: 8 additions & 0 deletions Documentation/feature-removal-schedule.txt
Original file line number Diff line number Diff line change
Expand Up @@ -529,3 +529,11 @@ When: 3.5
Why: The old kmap_atomic() with two arguments is deprecated, we only
keep it for backward compatibility for few cycles and then drop it.
Who: Cong Wang <amwang@redhat.com>

----------------------------

What: setitimer accepts user NULL pointer (value)
When: 3.6
Why: setitimer is not returning -EFAULT if user pointer is NULL. This
violates the spec.
Who: Sasikantha Babu <sasikanth.v19@gmail.com>
5 changes: 4 additions & 1 deletion kernel/itimer.c
Original file line number Diff line number Diff line change
Expand Up @@ -284,8 +284,11 @@ SYSCALL_DEFINE3(setitimer, int, which, struct itimerval __user *, value,
if (value) {
if(copy_from_user(&set_buffer, value, sizeof(set_buffer)))
return -EFAULT;
} else
} else {
memset((char *) &set_buffer, 0, sizeof(set_buffer));
WARN_ONCE(1, "setitimer: new_value pointer is NULL."
" Misfeature support will be removed\n");
}

error = do_setitimer(which, &set_buffer, ovalue ? &get_buffer : NULL);
if (error || !ovalue)
Expand Down

0 comments on commit aa2bf9b

Please sign in to comment.