* [PATCH 001/001] /fs/proc/: 'larger than buffer size' memory accesses by clear_user()
@ 2006-07-10 15:37 Adam Jerome
0 siblings, 0 replies; 2+ messages in thread
From: Adam Jerome @ 2006-07-10 15:37 UTC (permalink / raw)
To: linux-kernel
From: Adam B. Jerome <abj@novell.com>
This patch addresses potential 'larger than buffer size' memory accesses by clear_user().
Without this patch, this call to clear_user() can attempt to clear too many (tsz) bytes
resulting in a wrong (-EFAULT) return code by read_kcore().
Signed-off-by: Adam B. Jerome <abj@novell.com>
---
I do not subscribe to the list. Please CC posted answers/comments CC me <abj@novell.com>.
Thanks; -adam
diff -urpN linux-2.6-git/fs/proc/kcore.c linux-2.6-cur/fs/proc/kcore.c
--- linux-2.6-git/fs/proc/kcore.c 2006-07-07 15:39:23.000000000 -0600
+++ linux-2.6-cur/fs/proc/kcore.c 2006-07-07 16:11:58.000000000 -0600
@@ -384,7 +384,7 @@ read_kcore(struct file *file, char __use
*/
if (n) {
if (clear_user(buffer + tsz - n,
- tsz - n))
+ n))
return -EFAULT;
}
} else {
^ permalink raw reply [flat|nested] 2+ messages in thread
* [PATCH 001/001] /fs/proc/: 'larger than buffer size' memory accesses by clear_user()
@ 2006-07-10 15:32 Adam Jerome
0 siblings, 0 replies; 2+ messages in thread
From: Adam Jerome @ 2006-07-10 15:32 UTC (permalink / raw)
To: linux-kernel
From: Adam B. Jerome <abj@novell.com>
This patch addresses potential 'larger than buffer size' memory
accesses by clear_user().
Without this patch, this call to clear_user() can attempt to clear too
many (tsz) bytes
resulting in a wrong (-EFAULT) return code by read_kcore().
Signed-off-by: Adam B. Jerome <abj@novell.com>
---
I do not subscribe to the list. Please CC posted answers/comments CC me
<abj@novell.com>.
Thanks; -adam
diff -urpN linux-2.6-git/fs/proc/kcore.c linux-2.6-cur/fs/proc/kcore.c
--- linux-2.6-git/fs/proc/kcore.c 2006-07-07 15:39:23.000000000
-0600
+++ linux-2.6-cur/fs/proc/kcore.c 2006-07-07 16:11:58.000000000
-0600
@@ -384,7 +384,7 @@ read_kcore(struct file *file, char __use
*/
if (n) {
if (clear_user(buffer + tsz -
n,
- tsz -
n))
+ n))
return -EFAULT;
}
} else {
^ permalink raw reply [flat|nested] 2+ messages in thread
end of thread, other threads:[~2006-07-10 15:37 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2006-07-10 15:37 [PATCH 001/001] /fs/proc/: 'larger than buffer size' memory accesses by clear_user() Adam Jerome
-- strict thread matches above, loose matches on Subject: below --
2006-07-10 15:32 Adam Jerome
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox
Powered by JetHome