linux-kernel - Re: [PATCHv6] SGI UV: TLB shootdown using broadcast assist unit

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date:	Fri, 20 Jun 2008 13:34:57 +0200
From:	Ingo Molnar <mingo@...e.hu>
To:	Cliff Wickman <cpw@....com>
Cc:	linux-kernel@...r.kernel.org,
	the arch/x86 maintainers <x86@...nel.org>
Subject: Re: [PATCHv6] SGI UV: TLB shootdown using broadcast assist unit -
	v6 delta


* Cliff Wickman <cpw@....com> wrote:

>   > Found a potential security hole while doing that:
>   > static ssize_t uv_ptc_proc_write(struct file *file, const char __user *user,
>   >                              size_t count, loff_t *data)
>   >     if (copy_from_user(optstr, user, count))
>   >             return -EFAULT;
>   >
>   > is count guaranteed to never be larger than 64?
>  is fixed below.

applied to tip/x86/uv, thanks Cliff.

>  It adds tlb_uv.o to the Makefile.

hm, it was already there in tip/master, so i left this bit out.

>  	char optstr[64];
>  
> +	if (count > 64)
> +		return -EINVAL;

also, this should not be in /proc, but be moved to debugfs. See 
arch/x86/mm/dump_pagetables.c about how to interface to debugfs.

And the "64" value should become something like:

	static const int max_option_len = 64;

or so.

	Ingo
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/