Messages in this thread Patch in this message | | | From | BlaisorBlade <> | Subject | [PATCH] Missing return value check on do_write_mem | Date | Mon, 8 Mar 2004 12:46:33 +0100 |
| |
In drivers/char/mem.c do_write_mem can return -EFAULT but write_kmem forgets this and goes blindly.
Note: /dev/kmem can be written to only by root, so this *cannot* have security implications.
Also, do_write_mem takes two unused params and is static - so I've removed those. I actually double-checked this - however please test compilation on Sparc/m68k, since there are some #ifdef.
CC me on replies as I'm not subscribed. Thanks. -- Paolo Giarrusso, aka Blaisorblade Linux registered user n. 292729 --- ./drivers/char/mem.c.fix 2004-02-20 16:27:21.000000000 +0100 +++ ./drivers/char/mem.c 2004-03-08 12:17:23.000000000 +0100 @@ -96,13 +96,14 @@ } #endif -static ssize_t do_write_mem(struct file * file, void *p, unsigned long realp, - const char * buf, size_t count, loff_t *ppos) +static ssize_t do_write_mem(void *p, const char * buf, size_t count, + loff_t *ppos) { - ssize_t written; + ssize_t written = 0; - written = 0; #if defined(__sparc__) || (defined(__mc68000__) && defined(CONFIG_MMU)) + unsigned long realp = *ppos; + /* we don't have page 0 mapped on sparc and m68k.. */ if (realp < PAGE_SIZE) { unsigned long sz = PAGE_SIZE-realp; @@ -165,7 +166,7 @@ if (!valid_phys_addr_range(p, &count)) return -EFAULT; - return do_write_mem(file, __va(p), p, buf, count, ppos); + return do_write_mem(__va(p), buf, count, ppos); } static int mmap_mem(struct file * file, struct vm_area_struct * vma) @@ -276,7 +277,9 @@ if (count > (unsigned long) high_memory - p) wrote = (unsigned long) high_memory - p; - wrote = do_write_mem(file, (void*)p, p, buf, wrote, ppos); + wrote = do_write_mem((void*)p, buf, wrote, ppos); + if (wrote < 0) + return wrote; p += wrote; buf += wrote; | |