Patch to add check to get_chrdev_list and get_blkdev_list to prevent reads of
/proc/devices from spilling over the provided page if more than 4096 bytes of
string data are generated from all the registered character and block devices in
a system
Signed-off-by: Neil Horman <[email protected]>
fs/char_dev.c | 13 ++++++++++++-
fs/proc/proc_misc.c | 2 +-
include/linux/genhd.h | 2 +-
3 files changed, 14 insertions(+), 3 deletions(-)
--- linux-2.6-test/fs/char_dev.c.fixproc 2005-04-26 15:27:31.000000000 -0400
+++ linux-2.6-test/fs/char_dev.c 2005-04-26 15:25:31.000000000 -0400
@@ -57,10 +57,21 @@ int get_chrdev_list(char *page)
down(&chrdevs_lock);
for (i = 0; i < ARRAY_SIZE(chrdevs) ; i++) {
- for (cd = chrdevs[i]; cd; cd = cd->next)
+ for (cd = chrdevs[i]; cd; cd = cd->next) {
+ /*
+ * if the current name, plus the 5 extra characters
+ * in the device line for this entry
+ * would run us off the page, we're done
+ */
+ if((len+strlen(chrdevs[i].name) + 5) >= PAGE_SIZE)
+ goto page_full;
+
+
len += sprintf(page+len, "%3d %s\n",
cd->major, cd->name);
+ }
}
+page_full:
up(&chrdevs_lock);
return len;
--- linux-2.6-test/fs/proc/proc_misc.c.fixproc 2005-04-26 15:23:14.000000000 -0400
+++ linux-2.6-test/fs/proc/proc_misc.c 2005-04-26 15:23:32.000000000 -0400
@@ -433,7 +433,7 @@ static int devices_read_proc(char *page,
int count, int *eof, void *data)
{
int len = get_chrdev_list(page);
- len += get_blkdev_list(page+len);
+ len += get_blkdev_list(page+len, len);
return proc_calc_metrics(page, start, off, count, eof, len);
}
--- linux-2.6-test/include/linux/genhd.h.fixproc 2005-04-26 15:25:53.000000000 -0400
+++ linux-2.6-test/include/linux/genhd.h 2005-04-26 15:26:00.000000000 -0400
@@ -224,7 +224,7 @@ static inline void free_disk_stats(struc
extern void disk_round_stats(struct gendisk *disk);
/* drivers/block/genhd.c */
-extern int get_blkdev_list(char *);
+extern int get_blkdev_list(char *, int);
extern void add_disk(struct gendisk *disk);
extern void del_gendisk(struct gendisk *gp);
extern void unlink_gendisk(struct gendisk *gp);
--
/***************************************************
*Neil Horman
*Software Engineer
*Red Hat, Inc.
*[email protected]
*gpg keyid: 1024D / 0x92A74FA1
*http://pgp.mit.edu
***************************************************/
-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to [email protected]
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/
[Index of Archives]
[Kernel Newbies]
[Netfilter]
[Bugtraq]
[Photo]
[Stuff]
[Gimp]
[Yosemite News]
[MIPS Linux]
[ARM Linux]
[Linux Security]
[Linux RAID]
[Video 4 Linux]
[Linux for the blind]
[Linux Resources]
