/[linux-patches]/genpatches-2.6/tags/2.6.13-4/1016_2_lost-sockfd_put-in-32bit-compat-routing_ioctl.patch
Gentoo

Contents of /genpatches-2.6/tags/2.6.13-4/1016_2_lost-sockfd_put-in-32bit-compat-routing_ioctl.patch

Parent Directory Parent Directory | Revision Log Revision Log


Revision 168 - (show annotations) (download)
Sun Sep 18 11:19:29 2005 UTC (9 years, 7 months ago) by dsd
File size: 1633 byte(s)
2.6.13-4 release
1 From dev@sw.ru Fri Sep 9 02:55:06 2005
2 Date: Fri, 09 Sep 2005 13:59:48 +0400
3 From: Kirill Korotaev <dev@sw.ru>
4 To: security@kernel.org, Linus Torvalds <torvalds@osdl.org>,
5 Andrew Morton <akpm@osdl.org>, Chris Wright <chrisw@osdl.org>,
6 "Maxim Giryaev" <gem@sw.ru>
7 Subject: [PATCH] Lost sockfd_put() in routing_ioctl()
8
9 From: "Maxim Giryaev" <gem@sw.ru>
10
11 This patch adds lost sockfd_put() in 32bit compat rounting_ioctl() on
12 64bit platforms
13
14 I believe this is a security issues, since user can fget() file as many
15 times as he wants to. So file refcounter can be overlapped and first
16 fput() will free resources though there will be still structures
17 pointing to the file, mnt, dentry etc.
18 Also fput() sets f_dentry and f_vfsmnt to NULL,
19 so other file users will OOPS.
20
21 The oops can be done under files_lock and others, so this can be an
22 exploitable DoS on SMP. Didn't checked it on practice actually.
23
24 Signed-Off-By: Kirill Korotaev <dev@sw.ru>
25 Signed-Off-By: Maxim Giryaev <gem@sw.ru>
26 Signed-off-by: Chris Wright <chrisw@osdl.org>
27 ---
28 fs/compat_ioctl.c | 7 +++++--
29 1 files changed, 5 insertions(+), 2 deletions(-)
30
31 Index: linux-2.6.13.y/fs/compat_ioctl.c
32 ===================================================================
33 --- linux-2.6.13.y.orig/fs/compat_ioctl.c
34 +++ linux-2.6.13.y/fs/compat_ioctl.c
35 @@ -798,13 +798,16 @@ static int routing_ioctl(unsigned int fd
36 r = (void *) &r4;
37 }
38
39 - if (ret)
40 - return -EFAULT;
41 + if (ret) {
42 + ret = -EFAULT;
43 + goto out;
44 + }
45
46 set_fs (KERNEL_DS);
47 ret = sys_ioctl (fd, cmd, (unsigned long) r);
48 set_fs (old_fs);
49
50 +out:
51 if (mysock)
52 sockfd_put(mysock);
53

  ViewVC Help
Powered by ViewVC 1.1.20