lkml.org 
[lkml]   [2013]   [Nov]   [18]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
Patch in this message
/
Date
From
SubjectRe: [PATCH] FS: Fixed buffer overflow issue in seq_read()


On Tue, 19 Nov 2013, Al Viro wrote:
>
> seq_file: always clear m->count when we free m->buf

Ok, applied.

What do you think about then just abstracing out that now common sequence
of re-allocating a larger buffer, while clearing m->count?

IOW, something like the appended..

Linus

---
fs/seq_file.c | 18 ++++++++++--------
1 file changed, 10 insertions(+), 8 deletions(-)

diff --git a/fs/seq_file.c b/fs/seq_file.c
index 1d641bb108d2..f513e1efa49d 100644
--- a/fs/seq_file.c
+++ b/fs/seq_file.c
@@ -82,6 +82,14 @@ int seq_open(struct file *file, const struct seq_operations *op)
}
EXPORT_SYMBOL(seq_open);

+static int grow_seq_buf(struct seq_file *m)
+{
+ kfree(m->buf);
+ m->count = 0;
+ m->buf = kmalloc(m->size <<= 1, GFP_KERNEL);
+ return m->buf != NULL;
+}
+
static int traverse(struct seq_file *m, loff_t offset)
{
loff_t pos = 0, index;
@@ -135,10 +143,7 @@ static int traverse(struct seq_file *m, loff_t offset)

Eoverflow:
m->op->stop(m, p);
- kfree(m->buf);
- m->count = 0;
- m->buf = kmalloc(m->size <<= 1, GFP_KERNEL);
- return !m->buf ? -ENOMEM : -EAGAIN;
+ return grow_seq_buf(m) ? -EAGAIN : -ENOMEM;
}

/**
@@ -232,10 +237,7 @@ ssize_t seq_read(struct file *file, char __user *buf, size_t size, loff_t *ppos)
if (m->count < m->size)
goto Fill;
m->op->stop(m, p);
- kfree(m->buf);
- m->count = 0;
- m->buf = kmalloc(m->size <<= 1, GFP_KERNEL);
- if (!m->buf)
+ if (!grow_seq_buf(m))
goto Enomem;
m->version = 0;
pos = m->index;

\
 
 \ /
  Last update: 2013-11-19 05:21    [W:0.079 / U:0.936 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site