Messages in this thread Patch in this message | | | Date | Wed, 21 Feb 2018 21:44:11 +0300 | From | Alexey Dobriyan <> | Subject | [PATCH] proc: fix /proc/*/map_files lookup some more |
| |
I totally forgot that _parse_integer() accepts arbitrary amount of leading zeroes leading to the following:
OK # readlink /proc/1/map_files/56427ecba000-56427eddc000 /lib/systemd/systemd
bogus # readlink /proc/1/map_files/00000000000056427ecba000-56427eddc000 /lib/systemd/systemd # readlink /proc/1/map_files/56427ecba000-00000000000056427eddc000 /lib/systemd/systemd
Signed-off-by: Alexey Dobriyan <adobriyan@gmail.com> ---
fs/proc/base.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-)
--- a/fs/proc/base.c +++ b/fs/proc/base.c @@ -1913,9 +1913,11 @@ static int dname_to_vma_addr(struct dentry *dentry, unsigned long *start, unsigned long *end) { const char *str = dentry->d_name.name; + unsigned int len = dentry->d_name.len; unsigned long long sval, eval; - unsigned int len; + if (len > 1 && *str == '0') + return -EINVAL; len = _parse_integer(str, 16, &sval); if (len & KSTRTOX_OVERFLOW) return -EINVAL; @@ -1927,6 +1929,9 @@ static int dname_to_vma_addr(struct dentry *dentry, return -EINVAL; str++; + len = strlen(str); + if (len > 1 && *str == '0') + return -EINVAL; len = _parse_integer(str, 16, &eval); if (len & KSTRTOX_OVERFLOW) return -EINVAL;
| |