From: Chris Mason <mason@suse.com>
To: Alexander Viro <viro@math.psu.edu>
Cc: Marc Lehmann <pcg@goof.com>,
reiserfs-list@namesys.com, linux-kernel@vger.kernel.org,
vs@namesys.botik.ru
Subject: Re: [reiserfs-list] major security bug in reiserfs (may affect SuSE Linux)
Date: Wed, 10 Jan 2001 10:48:57 -0500 [thread overview]
Message-ID: <169460000.979141737@tiny> (raw)
In-Reply-To: <Pine.GSO.4.21.0101092129380.11512-100000@weyl.math.psu.edu>
On Wednesday, January 10, 2001 12:47:17 AM -0500 Alexander Viro
<viro@math.psu.edu> wrote:
> However, actual code really looks like the end of filldir(). If that's the
> case we are deep in it - argument of filldir() gets screwed. buf, that is.
> Since it happens after we've already done dereferencing of buf in
> filldir() and we don't trigger them... Fsck knows. copy_to_user() and
> put_user() should not be able to screw the kernel stack.
>
In filldir, I don't like the line where we ((char *)dirent += reclen ; If
reclen is much larger than the buffer sent from userspace, I don't see how
we stay in bounds.
-chris
-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
Please read the FAQ at http://www.tux.org/lkml/
next prev parent reply other threads:[~2001-01-10 15:49 UTC|newest]
Thread overview: 20+ messages / expand[flat|nested] mbox.gz Atom feed top
[not found] <20010110023208.B296@cerebro.laendle>
2001-01-10 2:23 ` [reiserfs-list] major security bug in reiserfs (may affect SuSE Linux) Chris Mason
2001-01-10 4:43 ` David Ford
2001-01-10 5:47 ` Alexander Viro
2001-01-10 15:48 ` Chris Mason [this message]
2001-01-10 17:38 ` Alexander Viro
2001-01-10 18:48 ` Chris Mason
2001-01-11 0:47 ` Alexander Viro
2001-01-10 16:41 ` Andrea Arcangeli
2001-01-10 16:02 ` Vladimir V. Saveliev
2001-01-10 16:09 ` Chris Mason
2001-01-10 16:29 ` [reiserfs-list] major security bug in reiserfs (may affect SuSELinux) Vladimir V. Saveliev
2001-01-10 17:03 ` [reiserfs-list] major security bug in reiserfs (may affect SuSE Linux) Stefan Traby
2001-01-10 17:11 ` Stefan Traby
2001-01-10 2:40 ` Chris Mason
2001-01-11 11:05 ` Hans Reiser
2001-01-09 23:42 Marc Lehmann
2001-01-10 0:43 ` [reiserfs-list] " John Morrison
2001-01-10 0:51 ` Chris Mason
2001-01-10 0:56 ` Vladimir V. Saveliev
2001-01-10 13:08 ` Gnea
2001-01-10 11:03 ` Dirk Mueller
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=169460000.979141737@tiny \
--to=mason@suse.com \
--cc=linux-kernel@vger.kernel.org \
--cc=pcg@goof.com \
--cc=reiserfs-list@namesys.com \
--cc=viro@math.psu.edu \
--cc=vs@namesys.botik.ru \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.