lkml.org 
[lkml]   [2008]   [Jun]   [20]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
Date
From
SubjectRe: [PATCHv6] SGI UV: TLB shootdown using broadcast assist unit - v6 delta

* Cliff Wickman <cpw@sgi.com> wrote:

> > Found a potential security hole while doing that:
> > static ssize_t uv_ptc_proc_write(struct file *file, const char __user *user,
> > size_t count, loff_t *data)
> > if (copy_from_user(optstr, user, count))
> > return -EFAULT;
> >
> > is count guaranteed to never be larger than 64?
> is fixed below.

applied to tip/x86/uv, thanks Cliff.

> It adds tlb_uv.o to the Makefile.

hm, it was already there in tip/master, so i left this bit out.

> char optstr[64];
>
> + if (count > 64)
> + return -EINVAL;

also, this should not be in /proc, but be moved to debugfs. See
arch/x86/mm/dump_pagetables.c about how to interface to debugfs.

And the "64" value should become something like:

static const int max_option_len = 64;

or so.

Ingo


\
 
 \ /
  Last update: 2008-06-20 13:37    [W:0.121 / U:0.920 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site