From: Martin Gadbois Subject: [PATCH] fix in fs/proc/generic.c: comparing unsigned int Date: Fri, 22 Oct 2004 14:45:41 -0400 Sender: linux-fsdevel-owner@vger.kernel.org Message-ID: <41795555.5020308@colubris.com> Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii; format=flowed Content-Transfer-Encoding: 7bit Return-path: Received: from gate.colubris.com ([206.162.167.230]:43004 "EHLO mail.colubris.com") by vger.kernel.org with ESMTP id S266820AbUJVStg (ORCPT ); Fri, 22 Oct 2004 14:49:36 -0400 To: linux-fsdevel@vger.kernel.org List-Id: linux-fsdevel.vger.kernel.org -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 In function proc_file_read(), if variable nbytes becomes "negative" it lead to a possibe overrun and segfault. It can become negative if the function dp->read_proc() returns n > nbytes. When nbyte is negative, the while comparaison is unsigned (size_t nbytes), and the check is always TRUE. This patch corrects the problem by using a int variable. diff -ur linux-2.4.28-pre4/fs/proc/generic.c linux-2.4.28-pre4-fix/fs/proc/generic.c - --- linux-2.4.28-pre4/fs/proc/generic.c 2004-10-22 11:40:42.000000000 -0400 +++ linux-2.4.28-pre4-fix/fs/proc/generic.c 2004-10-22 11:33:19.000000000 -0400 @@ -57,14 +57,15 @@ ~ char *start; ~ struct proc_dir_entry * dp; ~ loff_t pos = *ppos; + int bytes_left = nbytes; ~ dp = (struct proc_dir_entry *) inode->u.generic_ip; ~ if (!(page = (char*) __get_free_page(GFP_KERNEL))) ~ return -ENOMEM; - - while ((nbytes > 0) && !eof) + while ((bytes_left > 0) && !eof) ~ { - - count = MIN(PROC_BLOCK_SIZE, nbytes); + count = MIN(PROC_BLOCK_SIZE, bytes_left); ~ if ((unsigned)pos > INT_MAX) ~ break; @@ -115,7 +116,7 @@ ~ } ~ pos += start < page ? (long)start : n; /* Move down the file */ - - nbytes -= n; + bytes_left -= n; ~ buf += n; ~ retval += n; ~ } - -- ============== +----------------------------------------------+ Martin Gadbois | "Politics may come and go, but Greed goes on | S/W Developper | forever" --Qeng Ho motto, Fire upon the Deep | Colubris Networks Inc. +----------------------------------------------+ -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.2.4 (GNU/Linux) Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org iD8DBQFBeVVV9Y3/iTTCEDkRAgjaAJ4tH4U7g/kP23DI96i8/h9jUcM/EgCfa56F S8oRN77DrSNBMjr2b++HkO4= =szpU -----END PGP SIGNATURE-----