/[linux-patches]/genpatches-2.6/trunk/2.6.14/1178_6_proc-insanity-avoidance.patch
Gentoo

Contents of /genpatches-2.6/trunk/2.6.14/1178_6_proc-insanity-avoidance.patch

Parent Directory Parent Directory | Revision Log Revision Log


Revision 292 - (show annotations) (download) (as text)
Tue Jan 31 21:50:53 2006 UTC (14 years, 9 months ago) by johnm
File MIME type: text/x-diff
File size: 2309 byte(s)
Large update - thanks goes to Kerin Millar for the legwork.
1 From: Linus Torvalds <torvalds@osdl.org>
2 Date: Fri, 30 Dec 2005 17:59:56 +0000 (-0800)
3 Subject: [PATCH] Insanity avoidance in /proc (CVE-2005-4605)
4 X-Git-Url: http://www.kernel.org/git/?p=linux/kernel/git/chrisw/linux-2.6.14.y.git;a=commitdiff;h=eb558037b4bb4d965eb36df1def531ce7899254e
5
6 [PATCH] Insanity avoidance in /proc (CVE-2005-4605)
7
8 Insanity avoidance in /proc
9
10 The old /proc interfaces were never updated to use loff_t, and are just
11 generally broken. Now, we should be using the seq_file interface for
12 all of the proc files, but converting the legacy functions is more work
13 than most people care for and has little upside..
14
15 But at least we can make the non-LFS rules explicit, rather than just
16 insanely wrapping the offset or something.
17
18 Signed-off-by: Linus Torvalds <torvalds@osdl.org>
19 Signed-off-by: Chris Wright <chrisw@sous-sol.org>
20 Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
21 ---
22
23 --- a/fs/proc/generic.c
24 +++ b/fs/proc/generic.c
25 @@ -54,6 +54,18 @@ proc_file_read(struct file *file, char _
26 ssize_t n, count;
27 char *start;
28 struct proc_dir_entry * dp;
29 + unsigned long long pos;
30 +
31 + /*
32 + * Gaah, please just use "seq_file" instead. The legacy /proc
33 + * interfaces cut loff_t down to off_t for reads, and ignore
34 + * the offset entirely for writes..
35 + */
36 + pos = *ppos;
37 + if (pos > MAX_NON_LFS)
38 + return 0;
39 + if (nbytes > MAX_NON_LFS - pos)
40 + nbytes = MAX_NON_LFS - pos;
41
42 dp = PDE(inode);
43 if (!(page = (char*) __get_free_page(GFP_KERNEL)))
44 @@ -202,30 +214,17 @@ proc_file_write(struct file *file, const
45 static loff_t
46 proc_file_lseek(struct file *file, loff_t offset, int orig)
47 {
48 - lock_kernel();
49 -
50 - switch (orig) {
51 - case 0:
52 - if (offset < 0)
53 - goto out;
54 - file->f_pos = offset;
55 - unlock_kernel();
56 - return(file->f_pos);
57 - case 1:
58 - if (offset + file->f_pos < 0)
59 - goto out;
60 - file->f_pos += offset;
61 - unlock_kernel();
62 - return(file->f_pos);
63 - case 2:
64 - goto out;
65 - default:
66 - goto out;
67 - }
68 -
69 -out:
70 - unlock_kernel();
71 - return -EINVAL;
72 + loff_t retval = -EINVAL;
73 + switch (orig) {
74 + case 1:
75 + offset += file->f_pos;
76 + /* fallthrough */
77 + case 0:
78 + if (offset < 0 || offset > MAX_NON_LFS)
79 + break;
80 + file->f_pos = retval = offset;
81 + }
82 + return retval;
83 }
84
85 static int proc_notify_change(struct dentry *dentry, struct iattr *iattr)

  ViewVC Help
Powered by ViewVC 1.1.20