Messages in this thread Patch in this message | | | Date | Fri, 9 Nov 2018 14:31:53 +0300 | From | Cyrill Gorcunov <> | Subject | [PATCH v2] fs/proc: timers -- Test for potential index overflow |
| |
When showing timer's notify symbolic name make sure we never fetch a value sitting outside of the names array. Though the former issue displaying timer->it_sigev_notify has been fixed by Thomas in commit cef31d9af9082434, better to make sure we won't hit it again on furher modifications.
v2: Use explicit index overflow test (by tglx@). Since it should never happen add warn-once to notify.
Cc: Andrey Vagin <avagin@gmail.com> Cc: Thomas Gleixner <tglx@linutronix.de> Cc: Peter Zijlstra <peterz@infradead.org> Cc: Ingo Molnar <mingo@kernel.org> Signed-off-by: Cyrill Gorcunov <gorcunov@gmail.com> --- fs/proc/base.c | 6 ++++++ 1 file changed, 6 insertions(+)
Index: linux-ml.git/fs/proc/base.c =================================================================== --- linux-ml.git.orig/fs/proc/base.c +++ linux-ml.git/fs/proc/base.c @@ -2297,6 +2297,12 @@ static int show_timer(struct seq_file *m timer = list_entry((struct list_head *)v, struct k_itimer, list); notify = timer->it_sigev_notify; + if ((notify & ~SIGEV_THREAD_ID) >= ARRAY_SIZE(nstr)) { + WARN_ONCE(1, "timer: Bad signal notify mode %#x on ID %d\n", + notify, timer->it_id); + return -EINVAL; + } + seq_printf(m, "ID: %d\n", timer->it_id); seq_printf(m, "signal: %d/%px\n", timer->sigq->info.si_signo,
| |