Messages in this thread | | | Date | Mon, 28 Nov 2011 12:40:01 +0200 | Subject | Re: [PATCH] net: Fix corruption in /proc/*/net/dev_mcast | From | Daniel Baluta <> |
| |
>> dev_mc_seq_ops uses dev_seq_start/next/stop but only allocates >> sizeof(struct seq_net_private) of private data, whereas it expects >> sizeof(struct dev_iter_state): >> >> struct dev_iter_state { >> struct seq_net_private p; >> unsigned int pos; /* bucket << BUCKET_SPACE + offset */ >> }; >> >> Create dev_seq_open_ops and use it so we don't have to expose >> struct dev_iter_state.
Good catch, indeed! We've now checked and this is the only place where the problem happens.
>> +int dev_seq_open_ops(struct inode *inode, struct file *file, >> + const struct seq_operations *ops) >> +{ >> + return seq_open_net(inode, file, ops, sizeof(struct dev_iter_state)); >> +}
Perhaps you could use this function also in dev_seq_open (dev.c:4280).
>> static int dev_mc_seq_open(struct inode *inode, struct file *file) >> { >> - return seq_open_net(inode, file, &dev_mc_seq_ops, >> - sizeof(struct seq_net_private)); >> + return dev_seq_open_ops(inode, file, &dev_mc_seq_ops); >> } >> >> static const struct file_operations dev_mc_seq_fops = {
thanks, Daniel. -- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/
| |