Subject: [merged] mm-backing-devc-check-user-buffer-length-before-copying-data-to-the-related-user-buffer.patch removed from -mm tree To: gang.chen@xxxxxxxxxxx,jack@xxxxxxx,jmoyer@xxxxxxxxxx,tj@xxxxxxxxxx,mm-commits@xxxxxxxxxxxxxxx From: akpm@xxxxxxxxxxxxxxxxxxxx Date: Thu, 12 Sep 2013 12:45:11 -0700 The patch titled Subject: mm/backing-dev.c: check user buffer length before copying data to the related user buffer has been removed from the -mm tree. Its filename was mm-backing-devc-check-user-buffer-length-before-copying-data-to-the-related-user-buffer.patch This patch was dropped because it was merged into mainline or a subsystem tree ------------------------------------------------------ From: Chen Gang <gang.chen@xxxxxxxxxxx> Subject: mm/backing-dev.c: check user buffer length before copying data to the related user buffer '*lenp' may be less than "sizeof(kbuf)" so we must check this before the next copy_to_user(). pdflush_proc_obsolete() is called by sysctl which 'procname' is "nr_pdflush_threads", if the user passes buffer length less than "sizeof(kbuf)", it will cause issue. Signed-off-by: Chen Gang <gang.chen@xxxxxxxxxxx> Reviewed-by: Jan Kara <jack@xxxxxxx> Cc: Tejun Heo <tj@xxxxxxxxxx> Cc: Jeff Moyer <jmoyer@xxxxxxxxxx> Signed-off-by: Andrew Morton <akpm@xxxxxxxxxxxxxxxxxxxx> --- mm/backing-dev.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff -puN mm/backing-dev.c~mm-backing-devc-check-user-buffer-length-before-copying-data-to-the-related-user-buffer mm/backing-dev.c --- a/mm/backing-dev.c~mm-backing-devc-check-user-buffer-length-before-copying-data-to-the-related-user-buffer +++ a/mm/backing-dev.c @@ -652,7 +652,7 @@ int pdflush_proc_obsolete(struct ctl_tab { char kbuf[] = "0\n"; - if (*ppos) { + if (*ppos || *lenp < sizeof(kbuf)) { *lenp = 0; return 0; } _ Patches currently in -mm which might be from gang.chen@xxxxxxxxxxx are origin.patch sh64-kernel-use-usp-instead-of-fn.patch sh64-kernel-remove-useless-variable-regs.patch include-linux-interrupth-add-dummy-irq_set_irq_wake-for-generic_hardirqs.patch h8300-kernel-timer-timer8c-add-missing-semicolon.patch mm-kconfig-add-mmu-dependency-for-migration.patch -- To unsubscribe from this list: send the line "unsubscribe mm-commits" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html