lkml.org 
[lkml]   [2009]   [Apr]   [29]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    Date
    From
    Subject[patch 20/58] mm: do_xip_mapping_read: fix length calculation
    2.6.27-stable review patch.  If anyone has any objections, please let us know.

    ------------------

    From: Martin Schwidefsky <schwidefsky@de.ibm.com>

    upstream commit: 58984ce21d315b70df1a43644df7416ea7c9bfd8

    The calculation of the value nr in do_xip_mapping_read is incorrect. If
    the copy required more than one iteration in the do while loop the copies
    variable will be non-zero. The maximum length that may be passed to the
    call to copy_to_user(buf+copied, xip_mem+offset, nr) is len-copied but the
    check only compares against (nr > len).

    This bug is the cause for the heap corruption Carsten has been chasing
    for so long:

    ---
    mm/filemap_xip.c | 4 ++--
    1 file changed, 2 insertions(+), 2 deletions(-)

    --- a/mm/filemap_xip.c
    +++ b/mm/filemap_xip.c
    @@ -89,8 +89,8 @@ do_xip_mapping_read(struct address_space
    }
    }
    nr = nr - offset;
    - if (nr > len)
    - nr = len;
    + if (nr > len - copied)
    + nr = len - copied;

    error = mapping->a_ops->get_xip_mem(mapping, index, 0,
    &xip_mem, &xip_pfn);



    \
     
     \ /
      Last update: 2009-04-30 00:33    [W:0.019 / U:0.288 seconds]
    ©2003-2016 Jasper Spaans. hosted at Digital OceanAdvertise on this site