lkml.org 
[lkml]   [2018]   [Nov]   [9]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
Patch in this message
/
Date
From
Subject[PATCH v2] fs/proc: timers -- Test for potential index overflow
When showing timer's notify symbolic name make sure we never fetch a value
sitting outside of the names array. Though the former issue displaying
timer->it_sigev_notify has been fixed by Thomas in commit cef31d9af9082434,
better to make sure we won't hit it again on furher modifications.

v2: Use explicit index overflow test (by tglx@). Since
it should never happen add warn-once to notify.

Cc: Andrey Vagin <avagin@gmail.com>
Cc: Thomas Gleixner <tglx@linutronix.de>
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: Ingo Molnar <mingo@kernel.org>
Signed-off-by: Cyrill Gorcunov <gorcunov@gmail.com>
---
fs/proc/base.c | 6 ++++++
1 file changed, 6 insertions(+)

Index: linux-ml.git/fs/proc/base.c
===================================================================
--- linux-ml.git.orig/fs/proc/base.c
+++ linux-ml.git/fs/proc/base.c
@@ -2297,6 +2297,12 @@ static int show_timer(struct seq_file *m
timer = list_entry((struct list_head *)v, struct k_itimer, list);
notify = timer->it_sigev_notify;

+ if ((notify & ~SIGEV_THREAD_ID) >= ARRAY_SIZE(nstr)) {
+ WARN_ONCE(1, "timer: Bad signal notify mode %#x on ID %d\n",
+ notify, timer->it_id);
+ return -EINVAL;
+ }
+
seq_printf(m, "ID: %d\n", timer->it_id);
seq_printf(m, "signal: %d/%px\n",
timer->sigq->info.si_signo,
\
 
 \ /
  Last update: 2018-11-09 12:33    [W:0.060 / U:0.172 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site