[lkml]   [2001]   [Jan]   [10]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
Messages in this thread
SubjectRe: [reiserfs-list] major security bug in reiserfs (may affect SuSE Linux)

On Wed, 10 Jan 2001, Chris Mason wrote:

> On Wednesday, January 10, 2001 12:47:17 AM -0500 Alexander Viro
> <> wrote:
> > However, actual code really looks like the end of filldir(). If that's the
> > case we are deep in it - argument of filldir() gets screwed. buf, that is.
> > Since it happens after we've already done dereferencing of buf in
> > filldir() and we don't trigger them... Fsck knows. copy_to_user() and
> > put_user() should not be able to screw the kernel stack.
> >
> In filldir, I don't like the line where we ((char *)dirent += reclen ; If
> reclen is much larger than the buffer sent from userspace, I don't see how
> we stay in bounds.

So? copy_to_user() and put_user() will refuse to scramble the
kernel memory. IOW, dirent can be out of the userspace. Hell, user could
call getdents() and pass it a kernel pointer. Try it and you'll see what

BTW, in that particular line we are actually even protected from
getting too large dirent, since if the sum was out of the user space we
would die several lines above upon copy_to_user().

To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to
Please read the FAQ at

 \ /
  Last update: 2005-03-22 13:28    [W:0.044 / U:0.116 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site