Skip to contentSkip to conversation

random poolsize sysctl fix

PATCH In review Vasily Averin 2 participants 2 messages May 20, 2005 Random number driver

lore
Share & tools
lore
#0 lore raw

PATCH 1/1 random poolsize sysctl fix

Hello Marcelo,

SWSoft Linux kernel Team has discovered that your patch http://linux.bkbits.net:8080/linux-2.4/gnupatch@41e2c4fetTJmVti-Xxql21xXjfbpag
which should fix a random poolsize sysctl handler integer overflow, is wrong.
You have changed a variable definition in function proc_do_poolsize(), but you had to fix an another function, poolsize_strategy()

Vasily Averin
SWSoft Linux kernel Team

drivers/char/random.c renamed from drivers/char/random.c.rndps +2 -2
@@ -1771,7 +1771,7 @@ static int change_poolsize(int poolsize)
 static int proc_do_poolsize(ctl_table *table, int write, struct file *filp,
 			    void *buffer, size_t *lenp)
 {
-	unsigned int	ret;
+	int	ret;
 
 	sysctl_poolsize = random_state->poolinfo.POOLBYTES;
 
@@ -1787,7 +1787,7 @@ static int poolsize_strategy(ctl_table *
 			     void *oldval, size_t *oldlenp,
 			     void *newval, size_t newlen, void **context)
 {
-	int	len;
+	unsigned int	len;
 	
 	sysctl_poolsize = random_state->poolinfo.POOLBYTES;
 
#1 lore raw

Hi Vasily,

Quoted 8 lines · Vasily Averin

Hello Marcelo,

SWSoft Linux kernel Team has discovered that your patch
http://linux.bkbits.net:8080/linux-2.4/gnupatch@41e2c4fetTJmVti-Xxql21xXjfbpag
which should fix a random poolsize sysctl handler integer overflow, is wrong.
You have changed a variable definition in function proc_do_poolsize(), but you had to fix an another function, poolsize_strategy()

Ouch. Shame on me.

Recent v2.4 versions aren't vulnerable, at least on i386, where copy_from_user() does signed overflow checking.

Patch applied, thanks.

Quoted 20 lines
drivers/char/random.c renamed from drivers/char/random.c.rndps +2 -2
@@ -1771,7 +1771,7 @@ static int change_poolsize(int poolsize)
 static int proc_do_poolsize(ctl_table *table, int write, struct file *filp,
 			    void *buffer, size_t *lenp)
 {
-	unsigned int	ret;
+	int	ret;
 
 	sysctl_poolsize = random_state->poolinfo.POOLBYTES;
 
@@ -1787,7 +1787,7 @@ static int poolsize_strategy(ctl_table *
 			     void *oldval, size_t *oldlenp,
 			     void *newval, size_t newlen, void **context)
 {
-	int	len;
+	unsigned int	len;
 
 	sysctl_poolsize = random_state->poolinfo.POOLBYTES;