Messages in this thread | | | Date | Sat, 2 Apr 2005 10:34:38 -0600 | From | Robin Holt <> | Subject | qla_os.c causes proc_file_read: Apparent buffer overflow. |
| |
In qlaxxx/qla_os.c, the copy_mem_info function can cause proc_file_read to produce an "Apparent buffer overflow" error.
For illistration, lets assume we enter with
info->offset = 0 info->len = PAGE_SIZE (16384 on ia64 where I am seeing this) info->pos = 0
We pass in a data buffer that is 16386 bytes long.
As a result, the first len check in copy_mem_info will restrict len to 16384. At the end of copy, info->buffer += len will point info->buffer at the first byte of the next page.
When the qla2x00_proc_info read function returns to proc_file_read it will check start >= page + PAGE_SIZE in the else case on fs/proc/generic.c line 158, and produce a warning.
I am not sure what the correct fix is for this. Any guidance would be appreciated.
Thanks, Robin Holt - To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/
| |