[uml-devel] Little heap overflow in mconsole_kern.c

[BlaisorBlade <blaisorblade_spam@yahoo.it>]

In that file(releases 2.4.22-3um and -4um at least), we have this code:
[...]

void mconsole_interrupt(int irq, void *dev_id, struct pt_regs *regs)
{
	int fd;
	struct mconsole_entry *new;
	struct mc_request req;

[...]
			new = kmalloc(sizeof(req), GFP_ATOMIC);
			if(new == NULL)
				mconsole_reply(&req, "Out of memory", 1, 0);
			else {
				new->request = req;
				list_add(&new->list, &mc_requests);
			}
[...]
While new points to a mconsole_entry, the code allocates sizeof(mc_request), 
not sizeof(mconsole_entry), which is less than needed. I've looked for any 
reasons for this to be correct(even in the weird Linux list implementation), 
but seems just a typo(not noticed since the actual overflow is unlikely to 
happen, but it's there). Could you change it?(I didn't post a patch because 
it's simpler to edit the code at hand).
-- 
cat <<EOSIGN
Paolo Giarrusso, aka Blaisorblade
Linux Kernel 2.4.21/2.6.0-test on an i686; Linux registered user n. 292729
EOSIGN




-------------------------------------------------------
This sf.net email is sponsored by:ThinkGeek
Welcome to geek heaven.
http://thinkgeek.com/sf
_______________________________________________
User-mode-linux-devel mailing list
User-mode-linux-devel@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/user-mode-linux-devel