Messages in this thread Patch in this message | | | Date | Wed, 21 Feb 2018 22:53:40 +0300 | From | Alexey Dobriyan <> | Subject | [PATCH v2] proc: fix /proc/*/map_files lookup some more |
| |
I totally forgot that _parse_integer() accepts arbitrary amount of leading zeroes leading to the following:
OK # readlink /proc/1/map_files/56427ecba000-56427eddc000 /lib/systemd/systemd
bogus # readlink /proc/1/map_files/00000000000056427ecba000-56427eddc000 /lib/systemd/systemd # readlink /proc/1/map_files/56427ecba000-00000000000056427eddc000 /lib/systemd/systemd
Signed-off-by: Alexey Dobriyan <adobriyan@gmail.com> ---
fs/proc/base.c | 4 ++++ 1 file changed, 4 insertions(+)
--- a/fs/proc/base.c +++ b/fs/proc/base.c @@ -1916,6 +1916,8 @@ static int dname_to_vma_addr(struct dentry *dentry, unsigned long long sval, eval; unsigned int len; + if (str[0] == '0' && str[1]) + return -EINVAL; len = _parse_integer(str, 16, &sval); if (len & KSTRTOX_OVERFLOW) return -EINVAL; @@ -1927,6 +1929,8 @@ static int dname_to_vma_addr(struct dentry *dentry, return -EINVAL; str++; + if (str[0] == '0' && str[1]) + return -EINVAL; len = _parse_integer(str, 16, &eval); if (len & KSTRTOX_OVERFLOW) return -EINVAL;
| |