lkml.org 
[lkml]   [2013]   [Feb]   [26]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
Date
SubjectRe: bug in generic strncpy_from_user
From
On Tue, Feb 26, 2013 at 8:08 AM, Linus Torvalds
<torvalds@linux-foundation.org> wrote:
>
> It is totally untested, though. Does it work for you (and we should
> do the same thing for the grows-up case, obviously)?

Ok, thinking about this more, this is not good enough.

There is one case where growing into the previous/next vma is
perfectly ok: when the previous/next vma is the same stack vma, and
the reason we expanded it was because we had somehow unmapped the
stack in the middle.

Which isn't common or normal, but it has been known to happen. People
doing things like unmapping sensitive data in the middle of the stack
or whatever. We explicitly allow that case for the stack guard page
for that reason.

So I'll need to extend on that logic a bit more.

Linus


\
 
 \ /
  Last update: 2013-02-27 01:21    [W:0.058 / U:0.728 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site