Messages in this thread | | | Date | Fri, 16 Oct 2009 14:54:31 -0700 | From | Andrew Morton <> | Subject | Re: [PATCH] proc/pid/cmdline: Handle invalid cmdline change failures correctly. |
| |
On Sat, 03 Oct 2009 00:07:12 -0400 Timo Sirainen <tss@iki.fi> wrote:
> Handle access_process_vm() failures correctly in /proc/pid/cmdline. > This bug might have leaked kernel memory to userspace. >
The changelog fails to describe the bug.
> --- > fs/proc/base.c | 7 ++++--- > 1 files changed, 4 insertions(+), 3 deletions(-) > > diff --git a/fs/proc/base.c b/fs/proc/base.c > index 837469a..f66cc4c 100644 > --- a/fs/proc/base.c > +++ b/fs/proc/base.c > @@ -252,7 +252,7 @@ struct mm_struct *mm_for_maps(struct task_struct *task) > > static int proc_pid_cmdline(struct task_struct *task, char * buffer) > { > - int res = 0; > + int res = 0, res2; > unsigned int len; > struct mm_struct *mm = get_task_mm(task); > if (!mm) > @@ -277,8 +277,9 @@ static int proc_pid_cmdline(struct task_struct *task, char * buffer) > len = mm->env_end - mm->env_start; > if (len > PAGE_SIZE - res) > len = PAGE_SIZE - res; > - res += access_process_vm(task, mm->env_start, buffer+res, len, 0); > - res = strnlen(buffer, res); > + res2 = access_process_vm(task, mm->env_start, buffer+res, len, 0); > + if (res2 > 0) > + res = strnlen(buffer, res + res2); > } > }
And I don't see what it is. afacit the current code is correct.
| |