On Thu, Aug 24, 2006 at 11:25:37AM +0300, Amnon Shiloh wrote:
> Hi,
>
> Alright, I know that "mem_write" (fs/proc/base.c) is a "security hazard",
> but I need to use it anyway (as super-user only), and find it broken,
> somewhere between Linux-2.6.17 and Linux-2.6.18-rc4.
>
> The point is that in the beginning of the routine, "copied" is set to 0,
> but it is no good because in lines 805 and 812 it is set to other values.
> Finally, the routine returns as if it copied 12 (=ENOMEM) bytes less than
> it actually did.
True, it looks like the faulty commit is: de7587343bfebc186995ad294e3de0da382eb9bc
http://www.kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commitdiff_plain;h=99f895518368252ba862cc15ce4eb98ebbe1bec6;hp=8578cea7509cbdec25b31d08b48a92fcc3b1a9e3
The attached patch should fix it. Maybe that should go to 2.6.18.
Thanks for the bug report,
Frederik
Signed-off-by: Frederik Deweerdt <[email protected]>
--- fs/proc/base.c.orig 2006-08-24 13:57:22.000000000 +0200
+++ fs/proc/base.c 2006-08-24 13:57:10.000000000 +0200
@@ -797,7 +797,7 @@
static ssize_t mem_write(struct file * file, const char * buf,
size_t count, loff_t *ppos)
{
- int copied = 0;
+ int copied;
char *page;
struct task_struct *task = get_proc_task(file->f_dentry->d_inode);
unsigned long dst = *ppos;
@@ -814,6 +814,7 @@
if (!page)
goto out;
+ copied = 0;
while (count > 0) {
int this_len, retval;
-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to [email protected]
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/
[Index of Archives]
[Kernel Newbies]
[Netfilter]
[Bugtraq]
[Photo]
[Stuff]
[Gimp]
[Yosemite News]
[MIPS Linux]
[ARM Linux]
[Linux Security]
[Linux RAID]
[Video 4 Linux]
[Linux for the blind]
[Linux Resources]
