The patch titled
dcache: don't expose uninitialized memory in /proc/<pid>/fd/<fd>
has been removed from the -mm tree. Its filename was
dcache-dont-expose-uninitialized-memory-in.patch
This patch was dropped because it was merged into mainline or a subsystem tree
------------------------------------------------------
Subject: dcache: don't expose uninitialized memory in /proc/<pid>/fd/<fd>
From: J. Bruce Fields <bfields@xxxxxxxxxxxxxx>
Well, it's not especially important that target->d_iname get the contents
of dentry->d_iname, but it's important that it get initialized with
*something*, otherwise we're just exposing some random piece of memory to
anyone who reads the link at /proc/<pid>/fd/<fd> for the deleted file, when
it's still held open by someone.
I've run a test program that copies a short (<36 character) name ontop of a
long (>=36 character) name and see that the first time I run it, without
this patch, I get unpredicatable results out of /proc/<pid>/fd/<fd>.
Signed-off-by: J. Bruce Fields <bfields@xxxxxxxxxxxxxx>
Cc: Al Viro <viro@xxxxxxxxxxxxxxxxxx>
Cc: Christoph Hellwig <hch@xxxxxx>
Signed-off-by: Andrew Morton <akpm@xxxxxxxxxxxxxxxxxxxx>
---
fs/dcache.c | 2 ++
1 file changed, 2 insertions(+)
diff -puN fs/dcache.c~dcache-dont-expose-uninitialized-memory-in fs/dcache.c
--- a/fs/dcache.c~dcache-dont-expose-uninitialized-memory-in
+++ a/fs/dcache.c
@@ -1479,6 +1479,8 @@ static void switch_names(struct dentry *
* dentry:internal, target:external. Steal target's
* storage and make target internal.
*/
+ memcpy(target->d_iname, dentry->d_name.name,
+ dentry->d_name.len + 1);
dentry->d_name.name = target->d_name.name;
target->d_name.name = target->d_iname;
}
_
Patches currently in -mm which might be from bfields@xxxxxxxxxxxxxx are
origin.patch
reiser4.patch
-
To unsubscribe from this list: send the line "unsubscribe mm-commits" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at http://vger.kernel.org/majordomo-info.html
