[lkml]   [2010]   [Sep]   [24]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
Messages in this thread
    Patch in this message
    Subject[43/80] Prevent freeing uninitialized pointer in compat_do_readv_writev
    2.6.35-stable review patch.  If anyone has any objections, please let us know.


    From: Dan Rosenberg <>

    commit 767b68e96993e29e3480d7ecdd9c4b84667c5762 upstream.

    In 32-bit compatibility mode, the error handling for
    compat_do_readv_writev() may free an uninitialized pointer, potentially
    leading to all sorts of ugly memory corruption. This is reliably
    triggerable by unprivileged users by invoking the readv()/writev()
    syscalls with an invalid iovec pointer. The below patch fixes this to
    emulate the non-compat version.

    Introduced by commit b83733639a49 ("compat: factor out
    compat_rw_copy_check_uvector from compat_do_readv_writev")

    Signed-off-by: Dan Rosenberg <>
    Cc: Al Viro <>
    Signed-off-by: Linus Torvalds <>
    Signed-off-by: Greg Kroah-Hartman <>

    fs/compat.c | 2 +-
    1 file changed, 1 insertion(+), 1 deletion(-)

    --- a/fs/compat.c
    +++ b/fs/compat.c
    @@ -1150,7 +1150,7 @@ static ssize_t compat_do_readv_writev(in
    compat_ssize_t tot_len;
    struct iovec iovstack[UIO_FASTIOV];
    - struct iovec *iov;
    + struct iovec *iov = iovstack;
    ssize_t ret;
    io_fn_t fn;
    iov_fn_t fnv;

     \ /
      Last update: 2010-09-27 20:09    [W:0.025 / U:10.140 seconds]
    ©2003-2016 Jasper Spaans. hosted at Digital OceanAdvertise on this site