Subject: + mm-backing-devc-check-user-buffer-length-before-copying-data-to-the-related-user-buffer.patch added to -mm tree To: gang.chen@xxxxxxxxxxx,jack@xxxxxxx,jmoyer@xxxxxxxxxx,tj@xxxxxxxxxx From: akpm@xxxxxxxxxxxxxxxxxxxx Date: Tue, 20 Aug 2013 16:29:13 -0700 The patch titled Subject: mm/backing-dev.c: check user buffer length before copying data to the related user buffer has been added to the -mm tree. Its filename is mm-backing-devc-check-user-buffer-length-before-copying-data-to-the-related-user-buffer.patch This patch should soon appear at http://ozlabs.org/~akpm/mmots/broken-out/mm-backing-devc-check-user-buffer-length-before-copying-data-to-the-related-user-buffer.patch and later at http://ozlabs.org/~akpm/mmotm/broken-out/mm-backing-devc-check-user-buffer-length-before-copying-data-to-the-related-user-buffer.patch Before you just go and hit "reply", please: a) Consider who else should be cc'ed b) Prefer to cc a suitable mailing list as well c) Ideally: find the original patch on the mailing list and do a reply-to-all to that, adding suitable additional cc's *** Remember to use Documentation/SubmitChecklist when testing your code *** The -mm tree is included into linux-next and is updated there every 3-4 working days ------------------------------------------------------ From: Chen Gang <gang.chen@xxxxxxxxxxx> Subject: mm/backing-dev.c: check user buffer length before copying data to the related user buffer '*lenp' may be less than "sizeof(kbuf)" so we must check this before the next copy_to_user(). pdflush_proc_obsolete() is called by sysctl which 'procname' is "nr_pdflush_threads", if the user passes buffer length less than "sizeof(kbuf)", it will cause issue. Signed-off-by: Chen Gang <gang.chen@xxxxxxxxxxx> Cc: Jan Kara <jack@xxxxxxx> Cc: Tejun Heo <tj@xxxxxxxxxx> Cc: Jeff Moyer <jmoyer@xxxxxxxxxx> Signed-off-by: Andrew Morton <akpm@xxxxxxxxxxxxxxxxxxxx> --- mm/backing-dev.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff -puN mm/backing-dev.c~mm-backing-devc-check-user-buffer-length-before-copying-data-to-the-related-user-buffer mm/backing-dev.c --- a/mm/backing-dev.c~mm-backing-devc-check-user-buffer-length-before-copying-data-to-the-related-user-buffer +++ a/mm/backing-dev.c @@ -649,7 +649,7 @@ int pdflush_proc_obsolete(struct ctl_tab { char kbuf[] = "0\n"; - if (*ppos) { + if (*ppos || *lenp < sizeof(kbuf)) { *lenp = 0; return 0; } _ Patches currently in -mm which might be from gang.chen@xxxxxxxxxxx are sh64-kernel-use-usp-instead-of-fn.patch sh64-kernel-remove-useless-variable-regs.patch include-linux-interrupth-add-dummy-irq_set_irq_wake-for-generic_hardirqs.patch mm-page_allocc-use-__paginginit-instead-of-__init.patch mm-mremapc-call-pud_free-after-fail-calling-pmd_alloc.patch mm-backing-devc-check-user-buffer-length-before-copying-data-to-the-related-user-buffer.patch kernel-smpc-free-related-resources-when-failure-occurs-in-hotplug_cfd.patch linux-next.patch mm-kconfig-add-mmu-dependency-for-migration.patch -- To unsubscribe from this list: send the line "unsubscribe mm-commits" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html