* Kees Cook <keescook@xxxxxxxxxxxx> wrote: > @@ -702,6 +704,9 @@ static int mem_open(struct inode* inode, struct file* file) > struct task_struct *task = get_proc_task(file->f_path.dentry->d_inode); > struct mm_struct *mm; > > + if (sysctl_proc_pid_mem < 1) > + return -EACCES; This looks like an unprivileged user-space triggerable memory leak DoS. The task reference is already acquired at that point. See how easy it is to introduce bugs with potential security side-effects, even when the intention is to increase security? :-) ( Btw., this is why i generally prefer 'invariant' local variable definition blocks that have no serious side effects - it makes the flow more obvious. Local variables slip off the eye rather often and don't register as 'real' code.) Thanks, Ingo -- To unsubscribe from this list: send the line "unsubscribe linux-doc" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html
