linux-kernel - Re: bug reading /proc/sys/kernel/*: only first byte read.

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20070130132559.GA315@tv-sign.ru>
Date:	Tue, 30 Jan 2007 16:25:59 +0300
From:	Oleg Nesterov <oleg@...sign.ru>
To:	Andrew Morton <akpm@...l.org>
Cc:	Michael Tokarev <mjt@....msk.ru>,
	Kernel Mailing List <linux-kernel@...r.kernel.org>,
	"Eric W. Biederman" <ebiederm@...ssion.com>
Subject: Re: bug reading /proc/sys/kernel/*: only first byte read.

On 01/30, Andrew Morton wrote:
>
> @@ -1705,18 +1704,38 @@ static int _proc_do_string(void* data, i
>  		((char *) data)[len] = 0;
>  		*ppos += *lenp;
>  	} else {
> -		len = strlen(data);
> +		loff_t pos = *ppos;
> +		const size_t slen = strlen(data);
> +
> +		/*
> +		 * len is the amount of data to copy, and becomes the amount of
> +		 * data which was copied
> +		 */
> +		len = slen;
> +		if (pos > len) {
> +			*lenp = 0;
> +			return 0;
> +		}
>  		if (len > maxlen)
>  			len = maxlen;
>  		if (len > *lenp)
>  			len = *lenp;
> -		if (len)
> -			if(copy_to_user(buffer, data, len))
> -				return -EFAULT;
> -		if (len < *lenp) {
> -			if(put_user('\n', ((char __user *) buffer) + len))
> +		/* Don't copy past the end of the string */
> +		if (len > slen - pos)
> +			len = slen - pos;
> +		data += pos;
> +		/* Copy as much of the string as we can */
> +		if (len) {
> +			if (copy_to_user(buffer, data, len))
>  				return -EFAULT;
> -			len++;
> +		}
> +		/* If we copied the whole string, now write a \n */
> +		if (len + pos == slen) {
> +			if (len + pos < maxlen) {
                        ^^^^^^^^^^^^^^^^^^^^^^^
Shouldn't this be
			if (len < *lenp)

?

> +				if (put_user('\n', (char __user *)buffer + len))
> +					return -EFAULT;
> +				len++;
> +			}
>  		}
>  		*lenp = len;
>  		*ppos += len;

-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/