* Re: Bug in 2.4.0-test9 and test10 with sys_shmat()
@ 2000-11-17 8:09 aprasad
0 siblings, 0 replies; 2+ messages in thread
From: aprasad @ 2000-11-17 8:09 UTC (permalink / raw)
To: Richard Jerrell; +Cc: linux-kernel
>Sending -1 as the shmid to shmat will cause an oops. 2.2.16 caught this
>with simple boundry checking, so replace the lines
>if (!shm_sb || (shmid % SEQ_MULTIPLIER) == zero_id)
return -EINVAL;
>with
>if (!shm_sb || shmid < 0 || (shmid % SEQ_MULTIPLIER) == zero_id)
return -EINVAL;
-1 shmid is causing oops only when used with superuser privileges,
otherwise it returns -EINVAL.
regards
Anil
-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
Please read the FAQ at http://www.tux.org/lkml/
^ permalink raw reply [flat|nested] 2+ messages in thread
* Bug in 2.4.0-test9 and test10 with sys_shmat()
@ 2000-11-16 16:57 Richard Jerrell
0 siblings, 0 replies; 2+ messages in thread
From: Richard Jerrell @ 2000-11-16 16:57 UTC (permalink / raw)
To: linux-kernel
Sending -1 as the shmid to shmat will cause an oops. 2.2.16 caught this
with simple boundry checking, so replace the lines
if (!shm_sb || (shmid % SEQ_MULTIPLIER) == zero_id)
return -EINVAL;
with
if (!shm_sb || shmid < 0 || (shmid % SEQ_MULTIPLIER) == zero_id)
return -EINVAL;
Simple program to demonstrate the bug...
#include <sys/ipc.h>
#include <sys/shm.h>
int main(void) {
shmat(-1,0,0);
return 0;
}
Rich
jerrell@missioncriticallinux.com
-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
Please read the FAQ at http://www.tux.org/lkml/
^ permalink raw reply [flat|nested] 2+ messages in thread
end of thread, other threads:[~2000-11-17 8:46 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2000-11-17 8:09 Bug in 2.4.0-test9 and test10 with sys_shmat() aprasad
-- strict thread matches above, loose matches on Subject: below --
2000-11-16 16:57 Richard Jerrell
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox
all inboxes | Powered by JetHome®