Subject: + sysctl-refactor-sysctl-string-writing-logic.patch added to -mm tree
To: keescook@xxxxxxxxxxxx,rdunlap@xxxxxxxxxxxxx
From: akpm@xxxxxxxxxxxxxxxxxxxx
Date: Mon, 05 May 2014 15:00:26 -0700
The patch titled
Subject: sysctl: refactor sysctl string writing logic
has been added to the -mm tree. Its filename is
sysctl-refactor-sysctl-string-writing-logic.patch
This patch should soon appear at
http://ozlabs.org/~akpm/mmots/broken-out/sysctl-refactor-sysctl-string-writing-logic.patch
and later at
http://ozlabs.org/~akpm/mmotm/broken-out/sysctl-refactor-sysctl-string-writing-logic.patch
Before you just go and hit "reply", please:
a) Consider who else should be cc'ed
b) Prefer to cc a suitable mailing list as well
c) Ideally: find the original patch on the mailing list and do a
reply-to-all to that, adding suitable additional cc's
*** Remember to use Documentation/SubmitChecklist when testing your code ***
The -mm tree is included into linux-next and is updated
there every 3-4 working days
------------------------------------------------------
From: Kees Cook <keescook@xxxxxxxxxxxx>
Subject: sysctl: refactor sysctl string writing logic
Consolidate buffer length checking with new-line/end-of-line checking.
Additionally, instead of reading user memory twice, just do the assignment
during the loop.
This change doesn't affect the potential races here. It was already
possible to read a sysctl that was in the middle of a write. In both
cases, the string will always be NULL terminated. The pre-existing race
remains a problem to be solved.
Signed-off-by: Kees Cook <keescook@xxxxxxxxxxxx>
Cc: Randy Dunlap <rdunlap@xxxxxxxxxxxxx>
Signed-off-by: Andrew Morton <akpm@xxxxxxxxxxxxxxxxxxxx>
---
kernel/sysctl.c | 11 ++++-------
1 file changed, 4 insertions(+), 7 deletions(-)
diff -puN kernel/sysctl.c~sysctl-refactor-sysctl-string-writing-logic kernel/sysctl.c
--- a/kernel/sysctl.c~sysctl-refactor-sysctl-string-writing-logic
+++ a/kernel/sysctl.c
@@ -1712,21 +1712,18 @@ static int _proc_do_string(char *data, i
}
if (write) {
+ /* Start writing from beginning of buffer. */
len = 0;
+ *ppos += *lenp;
p = buffer;
- while (len < *lenp) {
+ while ((p - buffer) < *lenp && len < maxlen - 1) {
if (get_user(c, p++))
return -EFAULT;
if (c == 0 || c == '\n')
break;
- len++;
+ data[len++] = c;
}
- if (len >= maxlen)
- len = maxlen-1;
- if(copy_from_user(data, buffer, len))
- return -EFAULT;
data[len] = 0;
- *ppos += *lenp;
} else {
len = strlen(data);
if (len > maxlen)
_
Patches currently in -mm which might be from keescook@xxxxxxxxxxxx are
lib-vsprintf-add-%pt-format-specifier.patch
binfmt_elfc-use-get_random_int-to-fix-entropy-depleting.patch
ptrace-fix-fork-event-messages-across-pid-namespaces.patch
sysctl-clean-up-char-buffer-arguments.patch
sysctl-refactor-sysctl-string-writing-logic.patch
sysctl-allow-for-strict-write-position-handling.patch
sysctl-allow-for-strict-write-position-handling-fix.patch
tools-testing-selftests-sysctl-validate-sysctl_writes_strict.patch
tools-testing-selftests-sysctl-validate-sysctl_writes_strict-fix.patch
linux-next.patch
--
To unsubscribe from this list: send the line "unsubscribe mm-commits" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at http://vger.kernel.org/majordomo-info.html
