* [PATCH] compat. ifconf: fix limits
@ 2006-03-08 17:16 Randy.Dunlap
2006-03-09 0:46 ` David S. Miller
0 siblings, 1 reply; 4+ messages in thread
From: Randy.Dunlap @ 2006-03-08 17:16 UTC (permalink / raw)
To: netdev, linux-fsdevel; +Cc: Alexandra.Kossovsky, ak, akpm, torvalds
From: Randy Dunlap <rdunlap@xenotime.net>
A recent change to compat. dev_ifconf() in fs/compat_ioctl.c
causes ifconf data to be truncated 1 entry too early when copying it
to userspace. The correct amount of data (length) is returned,
but the final entry is empty (zero, not filled in).
The for-loop 'i' check should use <= to allow the final struct
ifreq32 to be copied. I also used the ifconf-corruption program
in kernel bugzilla #4746 to make sure that this change does not
re-introduce the corruption.
Signed-off-by: Randy Dunlap <rdunlap@xenotime.net>
---
fs/compat_ioctl.c | 2 +-
1 files changed, 1 insertion(+), 1 deletion(-)
--- linux-2616-rc5.orig/fs/compat_ioctl.c
+++ linux-2616-rc5/fs/compat_ioctl.c
@@ -446,7 +446,7 @@ static int dev_ifconf(unsigned int fd, u
ifr = ifc.ifc_req;
ifr32 = compat_ptr(ifc32.ifcbuf);
for (i = 0, j = 0;
- i + sizeof (struct ifreq32) < ifc32.ifc_len && j < ifc.ifc_len;
+ i + sizeof (struct ifreq32) <= ifc32.ifc_len && j < ifc.ifc_len;
i += sizeof (struct ifreq32), j += sizeof (struct ifreq)) {
if (copy_in_user(ifr32, ifr, sizeof (struct ifreq32)))
return -EFAULT;
---
^ permalink raw reply [flat|nested] 4+ messages in thread* Re: [PATCH] compat. ifconf: fix limits
2006-03-08 17:16 [PATCH] compat. ifconf: fix limits Randy.Dunlap
@ 2006-03-09 0:46 ` David S. Miller
2006-03-09 1:41 ` Randy.Dunlap
0 siblings, 1 reply; 4+ messages in thread
From: David S. Miller @ 2006-03-09 0:46 UTC (permalink / raw)
To: rdunlap; +Cc: netdev, linux-fsdevel, Alexandra.Kossovsky, ak, akpm, torvalds
From: "Randy.Dunlap" <rdunlap@xenotime.net>
Date: Wed, 8 Mar 2006 09:16:08 -0800
> From: Randy Dunlap <rdunlap@xenotime.net>
>
> A recent change to compat. dev_ifconf() in fs/compat_ioctl.c
> causes ifconf data to be truncated 1 entry too early when copying it
> to userspace. The correct amount of data (length) is returned,
> but the final entry is empty (zero, not filled in).
> The for-loop 'i' check should use <= to allow the final struct
> ifreq32 to be copied. I also used the ifconf-corruption program
> in kernel bugzilla #4746 to make sure that this change does not
> re-introduce the corruption.
>
> Signed-off-by: Randy Dunlap <rdunlap@xenotime.net>
Good catch, applied. Thanks Randy.
Is this one relevant for -stable?
^ permalink raw reply [flat|nested] 4+ messages in thread
* Re: [PATCH] compat. ifconf: fix limits
2006-03-09 0:46 ` David S. Miller
@ 2006-03-09 1:41 ` Randy.Dunlap
2006-03-09 1:41 ` David S. Miller
0 siblings, 1 reply; 4+ messages in thread
From: Randy.Dunlap @ 2006-03-09 1:41 UTC (permalink / raw)
To: David S. Miller
Cc: netdev, linux-fsdevel, Alexandra.Kossovsky, ak, akpm, torvalds
On Wed, 08 Mar 2006 16:46:27 -0800 (PST) David S. Miller wrote:
> From: "Randy.Dunlap" <rdunlap@xenotime.net>
> Date: Wed, 8 Mar 2006 09:16:08 -0800
>
> > From: Randy Dunlap <rdunlap@xenotime.net>
> >
> > A recent change to compat. dev_ifconf() in fs/compat_ioctl.c
> > causes ifconf data to be truncated 1 entry too early when copying it
> > to userspace. The correct amount of data (length) is returned,
> > but the final entry is empty (zero, not filled in).
> > The for-loop 'i' check should use <= to allow the final struct
> > ifreq32 to be copied. I also used the ifconf-corruption program
> > in kernel bugzilla #4746 to make sure that this change does not
> > re-introduce the corruption.
> >
> > Signed-off-by: Randy Dunlap <rdunlap@xenotime.net>
>
> Good catch, applied. Thanks Randy.
>
> Is this one relevant for -stable?
Yes, IMO. Have to wait for it to be merged upstream, right?
---
~Randy
^ permalink raw reply [flat|nested] 4+ messages in thread
* Re: [PATCH] compat. ifconf: fix limits
2006-03-09 1:41 ` Randy.Dunlap
@ 2006-03-09 1:41 ` David S. Miller
0 siblings, 0 replies; 4+ messages in thread
From: David S. Miller @ 2006-03-09 1:41 UTC (permalink / raw)
To: rdunlap; +Cc: netdev, linux-fsdevel, Alexandra.Kossovsky, ak, akpm, torvalds
From: "Randy.Dunlap" <rdunlap@xenotime.net>
Date: Wed, 8 Mar 2006 17:41:16 -0800
> On Wed, 08 Mar 2006 16:46:27 -0800 (PST) David S. Miller wrote:
>
> > Is this one relevant for -stable?
>
> Yes, IMO. Have to wait for it to be merged upstream, right?
I'll take care of everything, thanks Randy.
^ permalink raw reply [flat|nested] 4+ messages in thread
end of thread, other threads:[~2006-03-09 1:41 UTC | newest]
Thread overview: 4+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2006-03-08 17:16 [PATCH] compat. ifconf: fix limits Randy.Dunlap
2006-03-09 0:46 ` David S. Miller
2006-03-09 1:41 ` Randy.Dunlap
2006-03-09 1:41 ` David S. Miller
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).