Commit d585d2c0 authored by Andrew Morton's avatar Andrew Morton Committed by Linus Torvalds

[PATCH] fix unsigned issue with env_end - env_start

From: Chris Wright <chrisw@osdl.org>

Fix for CAN-2003-0462:  A race condition in the way env_start and
env_end pointers are initialized in the execve system call and used in
fs/proc/base.c on Linux 2.4 allows local users to cause a denial of
service (crash).
parent 02c541ec
...@@ -282,7 +282,7 @@ static int proc_pid_environ(struct task_struct *task, char * buffer) ...@@ -282,7 +282,7 @@ static int proc_pid_environ(struct task_struct *task, char * buffer)
int res = 0; int res = 0;
struct mm_struct *mm = get_task_mm(task); struct mm_struct *mm = get_task_mm(task);
if (mm) { if (mm) {
int len = mm->env_end - mm->env_start; unsigned int len = mm->env_end - mm->env_start;
if (len > PAGE_SIZE) if (len > PAGE_SIZE)
len = PAGE_SIZE; len = PAGE_SIZE;
res = access_process_vm(task, mm->env_start, buffer, len, 0); res = access_process_vm(task, mm->env_start, buffer, len, 0);
...@@ -294,7 +294,7 @@ static int proc_pid_environ(struct task_struct *task, char * buffer) ...@@ -294,7 +294,7 @@ static int proc_pid_environ(struct task_struct *task, char * buffer)
static int proc_pid_cmdline(struct task_struct *task, char * buffer) static int proc_pid_cmdline(struct task_struct *task, char * buffer)
{ {
int res = 0; int res = 0;
int len; unsigned int len;
struct mm_struct *mm = get_task_mm(task); struct mm_struct *mm = get_task_mm(task);
if (!mm) if (!mm)
goto out; goto out;
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment