/[linux-patches]/genpatches-2.6/trunk/2.6.14/1078_6_proc-insanity-avoidance.patch
Gentoo

Contents of /genpatches-2.6/trunk/2.6.14/1078_6_proc-insanity-avoidance.patch

Parent Directory Parent Directory | Revision Log Revision Log


Revision 252 - (show annotations) (download) (as text)
Tue Jan 10 19:01:52 2006 UTC (14 years, 10 months ago) by dsd
File MIME type: text/x-diff
File size: 2309 byte(s)
Linux 2.6.14.6 thanks to kerframil
1 From: Linus Torvalds <torvalds@osdl.org>
2 Date: Fri, 30 Dec 2005 17:59:56 +0000 (-0800)
3 Subject: [PATCH] Insanity avoidance in /proc (CVE-2005-4605)
4 X-Git-Url: http://www.kernel.org/git/?p=linux/kernel/git/chrisw/linux-2.6.14.y.git;a=commitdiff;h=eb558037b4bb4d965eb36df1def531ce7899254e
5
6 [PATCH] Insanity avoidance in /proc (CVE-2005-4605)
7
8 Insanity avoidance in /proc
9
10 The old /proc interfaces were never updated to use loff_t, and are just
11 generally broken. Now, we should be using the seq_file interface for
12 all of the proc files, but converting the legacy functions is more work
13 than most people care for and has little upside..
14
15 But at least we can make the non-LFS rules explicit, rather than just
16 insanely wrapping the offset or something.
17
18 Signed-off-by: Linus Torvalds <torvalds@osdl.org>
19 Signed-off-by: Chris Wright <chrisw@sous-sol.org>
20 Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
21 ---
22
23 --- a/fs/proc/generic.c
24 +++ b/fs/proc/generic.c
25 @@ -54,6 +54,18 @@ proc_file_read(struct file *file, char _
26 ssize_t n, count;
27 char *start;
28 struct proc_dir_entry * dp;
29 + unsigned long long pos;
30 +
31 + /*
32 + * Gaah, please just use "seq_file" instead. The legacy /proc
33 + * interfaces cut loff_t down to off_t for reads, and ignore
34 + * the offset entirely for writes..
35 + */
36 + pos = *ppos;
37 + if (pos > MAX_NON_LFS)
38 + return 0;
39 + if (nbytes > MAX_NON_LFS - pos)
40 + nbytes = MAX_NON_LFS - pos;
41
42 dp = PDE(inode);
43 if (!(page = (char*) __get_free_page(GFP_KERNEL)))
44 @@ -202,30 +214,17 @@ proc_file_write(struct file *file, const
45 static loff_t
46 proc_file_lseek(struct file *file, loff_t offset, int orig)
47 {
48 - lock_kernel();
49 -
50 - switch (orig) {
51 - case 0:
52 - if (offset < 0)
53 - goto out;
54 - file->f_pos = offset;
55 - unlock_kernel();
56 - return(file->f_pos);
57 - case 1:
58 - if (offset + file->f_pos < 0)
59 - goto out;
60 - file->f_pos += offset;
61 - unlock_kernel();
62 - return(file->f_pos);
63 - case 2:
64 - goto out;
65 - default:
66 - goto out;
67 - }
68 -
69 -out:
70 - unlock_kernel();
71 - return -EINVAL;
72 + loff_t retval = -EINVAL;
73 + switch (orig) {
74 + case 1:
75 + offset += file->f_pos;
76 + /* fallthrough */
77 + case 0:
78 + if (offset < 0 || offset > MAX_NON_LFS)
79 + break;
80 + file->f_pos = retval = offset;
81 + }
82 + return retval;
83 }
84
85 static int proc_notify_change(struct dentry *dentry, struct iattr *iattr)

  ViewVC Help
Powered by ViewVC 1.1.20