Messages in this thread | | | Date | Tue, 26 Feb 2013 15:43:55 -0800 | Subject | Re: bug in generic strncpy_from_user | From | Linus Torvalds <> |
| |
On Tue, Feb 26, 2013 at 8:08 AM, Linus Torvalds <torvalds@linux-foundation.org> wrote: > > It is totally untested, though. Does it work for you (and we should > do the same thing for the grows-up case, obviously)?
Ok, thinking about this more, this is not good enough.
There is one case where growing into the previous/next vma is perfectly ok: when the previous/next vma is the same stack vma, and the reason we expanded it was because we had somehow unmapped the stack in the middle.
Which isn't common or normal, but it has been known to happen. People doing things like unmapping sensitive data in the middle of the stack or whatever. We explicitly allow that case for the stack guard page for that reason.
So I'll need to extend on that logic a bit more.
Linus
| |