All of lore.kernel.org
 help / color / mirror / Atom feed
From: Timo Sirainen <tss@iki.fi>
To: linux-kernel@vger.kernel.org
Subject: [PATCH] proc/pid/cmdline: Handle invalid cmdline change failures correctly.
Date: Sat, 03 Oct 2009 00:07:12 -0400	[thread overview]
Message-ID: <1254542832.5405.6.camel@hurina> (raw)

Handle access_process_vm() failures correctly in /proc/pid/cmdline.
This bug might have leaked kernel memory to userspace.

Signed-off-by: Timo Sirainen <tss@iki.fi>
---
 fs/proc/base.c |    7 ++++---
 1 files changed, 4 insertions(+), 3 deletions(-)

diff --git a/fs/proc/base.c b/fs/proc/base.c
index 837469a..f66cc4c 100644
--- a/fs/proc/base.c
+++ b/fs/proc/base.c
@@ -252,7 +252,7 @@ struct mm_struct *mm_for_maps(struct task_struct *task)
 
 static int proc_pid_cmdline(struct task_struct *task, char * buffer)
 {
-	int res = 0;
+	int res = 0, res2;
 	unsigned int len;
 	struct mm_struct *mm = get_task_mm(task);
 	if (!mm)
@@ -277,8 +277,9 @@ static int proc_pid_cmdline(struct task_struct *task, char * buffer)
 			len = mm->env_end - mm->env_start;
 			if (len > PAGE_SIZE - res)
 				len = PAGE_SIZE - res;
-			res += access_process_vm(task, mm->env_start, buffer+res, len, 0);
-			res = strnlen(buffer, res);
+			res2 = access_process_vm(task, mm->env_start, buffer+res, len, 0);
+			if (res2 > 0)
+				res = strnlen(buffer, res + res2);
 		}
 	}
 out_mm:
-- 
1.6.3.3



             reply	other threads:[~2009-10-03  4:07 UTC|newest]

Thread overview: 3+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2009-10-03  4:07 Timo Sirainen [this message]
2009-10-16 21:54 ` [PATCH] proc/pid/cmdline: Handle invalid cmdline change failures correctly Andrew Morton
2009-10-16 21:59   ` Timo Sirainen

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=1254542832.5405.6.camel@hurina \
    --to=tss@iki.fi \
    --cc=linux-kernel@vger.kernel.org \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.