Commit d585d2c0 authored by Andrew Morton's avatar Andrew Morton Committed by Linus Torvalds

[PATCH] fix unsigned issue with env_end - env_start

From: Chris Wright <chrisw@osdl.org>

Fix for CAN-2003-0462:  A race condition in the way env_start and
env_end pointers are initialized in the execve system call and used in
fs/proc/base.c on Linux 2.4 allows local users to cause a denial of
service (crash).
parent 02c541ec
......@@ -282,7 +282,7 @@ static int proc_pid_environ(struct task_struct *task, char * buffer)
int res = 0;
struct mm_struct *mm = get_task_mm(task);
if (mm) {
int len = mm->env_end - mm->env_start;
unsigned int len = mm->env_end - mm->env_start;
if (len > PAGE_SIZE)
len = PAGE_SIZE;
res = access_process_vm(task, mm->env_start, buffer, len, 0);
......@@ -294,7 +294,7 @@ static int proc_pid_environ(struct task_struct *task, char * buffer)
static int proc_pid_cmdline(struct task_struct *task, char * buffer)
{
int res = 0;
int len;
unsigned int len;
struct mm_struct *mm = get_task_mm(task);
if (!mm)
goto out;
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment