linux-kernel - Re: [PATCH] Fix /proc/pid/pagemap return length calculation

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20070806033446.GU11115@waste.org>
Date:	Sun, 5 Aug 2007 22:34:46 -0500
From:	Matt Mackall <mpm@...enic.com>
To:	Dave Boutcher <boutcher@...umn.edu>
Cc:	linux-kernel@...r.kernel.org, Dave Hansen <haveblue@...ibm.com>,
	Andrew Morton <akpm@...ux-foundation.org>
Subject: Re: [PATCH] Fix /proc/pid/pagemap return length calculation

On Sun, Aug 05, 2007 at 09:03:23PM -0500, Dave Boutcher wrote:
> 
> /proc/pid/pagemap has a header (usually 8 bytes) the length
> of which needs to be compensated for when converting from
> proc file offset to page number.  The calculation of the
> starting page number (svpfn) compensates for this, but the
> calculation of the ending page number (evpfn) does not, resulting
> in reads returning 8 bytes more than were asked for and
> nastily overwriting userspace memory.

Does this mean you're running on a 64-bit arch? I'd already fixed this
locally, but it was off by 4 for me.

Acked-by: Matt Mackall <mpm@...enic.com>
 
> Diffed against 2.6.23-rc1-mm2
> 
> Signed-off-by: Dave Boutcher <boutcher@...umn.edu>
> ---
>  fs/proc/task_mmu.c |    2 +-
>  1 files changed, 1 insertions(+), 1 deletions(-)
> 
> diff --git a/fs/proc/task_mmu.c b/fs/proc/task_mmu.c
> index 4594f15..b2baeab 100644
> --- a/fs/proc/task_mmu.c
> +++ b/fs/proc/task_mmu.c
> @@ -627,7 +627,7 @@ static ssize_t pagemap_read(struct file *file, char __user *buf,
>  	addr = PAGE_SIZE * svpfn;
>  	if ((svpfn + 1) * sizeof(unsigned long) != src)
>  		goto out;
> -	evpfn = min((src + count) / sizeof(unsigned long),
> +	evpfn = min((src + count) / sizeof(unsigned long) - 1,
>  		    ((~0UL) >> PAGE_SHIFT) + 1);
>  	count = (evpfn - svpfn) * sizeof(unsigned long);
>  	end = PAGE_SIZE * evpfn;
> -- 
> 1.4.4.2

-- 
Mathematics is the supreme nostalgia of our time.
-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/