: 4/4GB: Incorrect bound check in do_getname()
PATCH 1/1 : 4/4GB: Incorrect bound check in do_getname()
This patch fixes incorrect address range check in do_getname(). Theoretically this can lead to do_getname() failure on kernel address space string on the TASK_SIZE boundary addresses when 4GB split is ON.
Signed-off-by Kirill Korotaev <[email protected]>
Kirill
P.S. These 4GB split patches are against modified 2.6.8.1 kernel, but should be appliable to last Fedora kernels
fs/namei.c renamed from fs/namei.c.tasksize +5 -4
@@ -106,11 +106,12 @@int retval;unsigned long len =PATH_MAX ; -if ((unsigned long ) filename >=TASK_SIZE ) { -if (!segment_eq (get_fs (),KERNEL_DS )) +if (!segment_eq (get_fs (),KERNEL_DS )) { +if ((unsigned long ) filename >=TASK_SIZE )return -EFAULT ; - }else if (TASK_SIZE - (unsigned long ) filename <PATH_MAX ) - len =TASK_SIZE - (unsigned long ) filename; +if (TASK_SIZE - (unsigned long ) filename <PATH_MAX ) + len =TASK_SIZE - (unsigned long ) filename; + } retval =strncpy_from_user ((char *)page, filename, len);if (retval >0 ) {