From: Quinn Jensen <jensenq@Lineo.COM>
To: owner-linux-mips@oss.sgi.com
Cc: Erik Andersen <andersen@lineo.com>,
Michael Shmulevich <michaels@jungo.com>,
busybox@opensource.lineo.com,
"linux-mips@oss.sgi.com" <linux-mips@oss.sgi.com>
Subject: Re: [BusyBox] 0.48 - Can't mount /proc
Date: Thu, 11 Jan 2001 08:52:08 -0700 [thread overview]
Message-ID: <3A5DD6A8.1040600@Lineo.COM> (raw)
In-Reply-To: 20010111130450.B5811@paradigm.rfc822.org
Here's a kernel patch. The __access_ok macro looks one byte
too far and fails. Since copy_mount_options() isn't
sure how long the string arguments are, it just copies
to the end of the page. Since this is on busybox's
stack, the copy wants to go all the way to 0x7FFFFFF
and hits this corner case.
Quinn Jensen
jensenq@lineo.com
--- linux-sgi-2.4.0-test11-pristine/include/asm-mips/uaccess.h Wed Oct 4 19:19:02 2000
+++ linux/include/asm-mips/uaccess.h Wed Jan 10 16:20:35 2001
@@ -46,7 +46,7 @@
* - OR we are in kernel mode.
*/
#define __access_ok(addr,size,mask) \
- (((__signed__ long)((mask)&(addr | size | (addr+size)))) >= 0)
+ (((__signed__ long)((mask)&(addr | size | (addr+size-1)))) >= 0)
#define __access_mask ((long)(get_fs().seg))
#define access_ok(type,addr,size) \
WARNING: multiple messages have this Message-ID (diff)
From: Quinn Jensen <jensenq@Lineo.COM>
To: owner-linux-mips@oss.sgi.com
Cc: Erik Andersen <andersen@lineo.com>,
Michael Shmulevich <michaels@jungo.com>,
busybox@opensource.lineo.com
Subject: Re: [BusyBox] 0.48 - Can't mount /proc
Date: Thu, 11 Jan 2001 08:52:08 -0700 [thread overview]
Message-ID: <3A5DD6A8.1040600@Lineo.COM> (raw)
Message-ID: <20010111155208.C7NhGpRUi5Iw8YHu90BMSg2AE6j3HLSxR4N1ggKF8d8@z> (raw)
In-Reply-To: 20010111130450.B5811@paradigm.rfc822.org
Here's a kernel patch. The __access_ok macro looks one byte
too far and fails. Since copy_mount_options() isn't
sure how long the string arguments are, it just copies
to the end of the page. Since this is on busybox's
stack, the copy wants to go all the way to 0x7FFFFFF
and hits this corner case.
Quinn Jensen
jensenq@lineo.com
--- linux-sgi-2.4.0-test11-pristine/include/asm-mips/uaccess.h Wed Oct 4 19:19:02 2000
+++ linux/include/asm-mips/uaccess.h Wed Jan 10 16:20:35 2001
@@ -46,7 +46,7 @@
* - OR we are in kernel mode.
*/
#define __access_ok(addr,size,mask) \
- (((__signed__ long)((mask)&(addr | size | (addr+size)))) >= 0)
+ (((__signed__ long)((mask)&(addr | size | (addr+size-1)))) >= 0)
#define __access_mask ((long)(get_fs().seg))
#define access_ok(type,addr,size) \
next prev parent reply other threads:[~2001-01-11 15:52 UTC|newest]
Thread overview: 8+ messages / expand[flat|nested] mbox.gz Atom feed top
[not found] <3A5CAC53.60700@jungo.com>
[not found] ` <20010110122159.A24714@lineo.com>
2001-01-11 7:28 ` [BusyBox] 0.48 - Can't mount /proc Michael Shmulevich
2001-01-11 7:28 ` Michael Shmulevich
2001-01-11 11:48 ` Erik Andersen
2001-01-11 12:04 ` Florian Lohoff
2001-01-11 15:52 ` Quinn Jensen [this message]
2001-01-11 15:52 ` Quinn Jensen
2001-01-16 7:13 ` Ralf Baechle
2001-01-11 20:25 ` Ralf Baechle
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=3A5DD6A8.1040600@Lineo.COM \
--to=jensenq@lineo.com \
--cc=andersen@lineo.com \
--cc=busybox@opensource.lineo.com \
--cc=linux-mips@oss.sgi.com \
--cc=michaels@jungo.com \
--cc=owner-linux-mips@oss.sgi.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.