Messages in this thread | | | Date | Fri, 20 Jun 2008 13:34:57 +0200 | From | Ingo Molnar <> | Subject | Re: [PATCHv6] SGI UV: TLB shootdown using broadcast assist unit - v6 delta |
| |
* Cliff Wickman <cpw@sgi.com> wrote:
> > Found a potential security hole while doing that: > > static ssize_t uv_ptc_proc_write(struct file *file, const char __user *user, > > size_t count, loff_t *data) > > if (copy_from_user(optstr, user, count)) > > return -EFAULT; > > > > is count guaranteed to never be larger than 64? > is fixed below.
applied to tip/x86/uv, thanks Cliff.
> It adds tlb_uv.o to the Makefile.
hm, it was already there in tip/master, so i left this bit out.
> char optstr[64]; > > + if (count > 64) > + return -EINVAL;
also, this should not be in /proc, but be moved to debugfs. See arch/x86/mm/dump_pagetables.c about how to interface to debugfs.
And the "64" value should become something like:
static const int max_option_len = 64;
or so.
Ingo
| |