diff options
| author | Dan Rosenberg <drosenberg@vsecurity.com> | 2010-09-22 14:32:56 -0400 |
|---|---|---|
| committer | Greg Kroah-Hartman <gregkh@suse.de> | 2010-09-26 17:18:28 -0700 |
| commit | 32e987bf2db7941e5a27bfa4dbed50663c5b1ba2 (patch) | |
| tree | 6b95a75ed984ca6c13b532f2f077b69735760666 | |
| parent | e658aee24443e17c08424ae4ce193735c7fde737 (diff) | |
| download | kernel-common-32e987bf2db7941e5a27bfa4dbed50663c5b1ba2.tar.gz kernel-common-32e987bf2db7941e5a27bfa4dbed50663c5b1ba2.tar.bz2 kernel-common-32e987bf2db7941e5a27bfa4dbed50663c5b1ba2.zip | |
Prevent freeing uninitialized pointer in compat_do_readv_writev
commit 767b68e96993e29e3480d7ecdd9c4b84667c5762 upstream.
In 32-bit compatibility mode, the error handling for
compat_do_readv_writev() may free an uninitialized pointer, potentially
leading to all sorts of ugly memory corruption. This is reliably
triggerable by unprivileged users by invoking the readv()/writev()
syscalls with an invalid iovec pointer. The below patch fixes this to
emulate the non-compat version.
Introduced by commit b83733639a49 ("compat: factor out
compat_rw_copy_check_uvector from compat_do_readv_writev")
Signed-off-by: Dan Rosenberg <dan.j.rosenberg@gmail.com>
Cc: Al Viro <viro@zeniv.linux.org.uk>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
| -rw-r--r-- | fs/compat.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/fs/compat.c b/fs/compat.c index 6490d2134ff3..af7c2301a2ec 100644 --- a/fs/compat.c +++ b/fs/compat.c @@ -1150,7 +1150,7 @@ static ssize_t compat_do_readv_writev(int type, struct file *file, { compat_ssize_t tot_len; struct iovec iovstack[UIO_FASTIOV]; - struct iovec *iov; + struct iovec *iov = iovstack; ssize_t ret; io_fn_t fn; iov_fn_t fnv; |