From: Chen Gang <gang.chen@asianux.com>
To: Jan Kara <jack@suse.cz>, Tejun Heo <tj@kernel.org>,
jmoyer@redhat.com, Jens Axboe <axboe@kernel.dk>
Cc: Andrew Morton <akpm@linux-foundation.org>, linux-mm@kvack.org
Subject: [PATCH] mm/backing-dev.c: check user buffer length before copy data to the related user buffer.
Date: Tue, 20 Aug 2013 11:23:24 +0800 [thread overview]
Message-ID: <5212E12C.5010005@asianux.com> (raw)
'*lenp' may be less than "sizeof(kbuf)", need check it before the next
copy_to_user().
pdflush_proc_obsolete() is called by sysctl which 'procname' is
"nr_pdflush_threads", if the user passes buffer length less than
"sizeof(kbuf)", it will cause issue.
Signed-off-by: Chen Gang <gang.chen@asianux.com>
---
mm/backing-dev.c | 2 +-
1 files changed, 1 insertions(+), 1 deletions(-)
diff --git a/mm/backing-dev.c b/mm/backing-dev.c
index e04454c..2674671 100644
--- a/mm/backing-dev.c
+++ b/mm/backing-dev.c
@@ -649,7 +649,7 @@ int pdflush_proc_obsolete(struct ctl_table *table, int write,
{
char kbuf[] = "0\n";
- if (*ppos) {
+ if (*ppos || *lenp < sizeof(kbuf)) {
*lenp = 0;
return 0;
}
--
1.7.7.6
--
To unsubscribe, send a message with 'unsubscribe linux-mm' in
the body to majordomo@kvack.org. For more info on Linux MM,
see: http://www.linux-mm.org/ .
Don't email: <a href=mailto:"dont@kvack.org"> email@kvack.org </a>
next reply other threads:[~2013-08-20 3:24 UTC|newest]
Thread overview: 7+ messages / expand[flat|nested] mbox.gz Atom feed top
2013-08-20 3:23 Chen Gang [this message]
2013-08-20 15:28 ` Jan Kara
2013-08-21 2:28 ` Chen Gang
2013-08-20 23:29 ` Andrew Morton
2013-08-21 3:35 ` Chen Gang
2013-08-21 3:45 ` Andrew Morton
2013-08-21 3:56 ` Chen Gang
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=5212E12C.5010005@asianux.com \
--to=gang.chen@asianux.com \
--cc=akpm@linux-foundation.org \
--cc=axboe@kernel.dk \
--cc=jack@suse.cz \
--cc=jmoyer@redhat.com \
--cc=linux-mm@kvack.org \
--cc=tj@kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox