| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Message-ID: <op.thv4lpt0iudtyh@master> Date: Mon, 23 Oct 2006 22:02:03 +0200 From: "Thomas Maier" <balagi@...tmail.de> To: "Greg KH" <gregkh@...e.de> Cc: linux-kernel@...r.kernel.org Subject: Re: [PATCH] 2.6.19-rc2-mm2 sysfs: sysfs_write_file() writes zero terminated data Hello, Sorry, maybe i missed something, but according to the code in fs/sysfs/file.c the "write" sequence is: - call to sysfs_write_file(ubuf, count) - if (!sysfsbuf->page) alloc zeroed page - copy count bytes from ubuf to sysfsbuf->page - call store(sysfsbuf->page, count) When you write again to the file before closing it (possible?!), and count is less the the previous count you may not pass a zero terminated string/data to store(). -Thomas Am 22.10.2006, 20:39 Uhr, schrieb Greg KH <gregkh@...e.de>: > On Sun, Oct 22, 2006 at 07:17:47PM +0200, Thomas Maier wrote: >> Hello, >> >> since most of the files in sysfs are text files, >> it would be nice, if the "store" function called >> during sysfs_write_file() gets a zero terminated >> string / data. >> The current implementation seems not to ensure this. >> (But only if it is the first time the zeroed buffer >> page is allocated.) > > Have you seen sysfs buffers being passed to the store() function in a > non-null terminated manner? How? > > Are you seeking backward and then writing again to the file somehow? > > thanks, > > greg k-h > > - To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@...r.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/
Powered by blists - more mailing lists