Attachment 31057 Details for Bug 71782

[patch] mail with patch as attachment

epoll.mail (text/plain), 3.02 KB, created by Ludwig Nussel on 2005-03-09 11:22:15 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Ludwig Nussel

Created: 2005-03-09 11:22:15 UTC

Size: 3.02 KB

patch

obsolete

>Linus security-list policy applies to this one. 
>
>
>----- Forwarded message from Linus Torvalds <torvalds@osdl.org> -----
>
>Date: Tue, 8 Mar 2005 09:29:24 -0800 (PST)
>From: Linus Torvalds <torvalds@osdl.org>
>To: Kernel security list <security@kernel.org>
>X-Spam-Status: No, hits=-6.1 required=5.0
>	tests=AWL,BAYES_01,PATCH_UNIFIED_DIFF,RCVD_IN_ORBS,
>	      USER_AGENT_PINE
>	version=2.55
>X-Spam-Checker-Version: SpamAssassin 2.55 (1.174.2.19-2003-05-19-exp)
>X-MIMEDefang-Filter: osdl$Revision: 1.104 $
>X-Scanned-By: MIMEDefang 2.36
>Cc: 
>Subject: [Security] epoll hole..
>X-BeenThere: security@linux.kernel.org
>X-Mailman-Version: 2.1.5
>Precedence: list
>List-Id: Linux kernel security bug reports <security.linux.kernel.org>
>List-Unsubscribe: <http://linux.kernel.org/mailman/listinfo/security>,
>	<mailto:security-request@linux.kernel.org?subject=unsubscribe>
>List-Archive: <http://linux.kernel.org/mailman/private/security>
>List-Post: <mailto:security@linux.kernel.org>
>List-Help: <mailto:security-request@linux.kernel.org?subject=help>
>List-Subscribe: <http://linux.kernel.org/mailman/listinfo/security>,
>	<mailto:security-request@linux.kernel.org?subject=subscribe>
>Errors-To: security-bounces@linux.kernel.org
>X-RedHat-Spam-Score: 0 
>
>
>This allows overwriting of the first few kB of physical memory on x86.
>
>It usually doesn't actually contain anything (the first 4kB are left alone 
>for dosemu etc to read the original 16-bit interrupt descriptors, and the 
>rest is just about the last thing we ever allocate, so it's usually 
>unused), but still..
>
>Already in my tree, soon to be pushed out.
>
>		Linus
>----
># This is a BitKeeper generated diff -Nru style patch.
>#
># ChangeSet
>#   2005/03/08 08:18:50-08:00 torvalds@ppc970.osdl.org 
>#   epoll: return proper error on overflow condition
>#   
>#   Noted by Georgi Guninski.
># 
># fs/eventpoll.c
>#   2005/03/08 08:18:40-08:00 torvalds@ppc970.osdl.org +2 -1
>#   epoll: return proper error on overflow condition
>#   
>#   Noted by Georgi Guninski.
># 
>diff -Nru a/fs/eventpoll.c b/fs/eventpoll.c
>--- a/fs/eventpoll.c	2005-03-08 09:24:04 -08:00
>+++ b/fs/eventpoll.c	2005-03-08 09:24:04 -08:00
>@@ -619,6 +619,7 @@
> 	return error;
> }
> 
>+#define MAX_EVENTS (INT_MAX / sizeof(struct epoll_event))
> 
> /*
>  * Implement the event wait interface for the eventpoll file. It is the kernel
>@@ -635,7 +636,7 @@
> 		     current, epfd, events, maxevents, timeout));
> 
> 	/* The maximum number of event must be greater than zero */
>-	if (maxevents <= 0)
>+	if (maxevents <= 0 || maxevents > MAX_EVENTS)
> 		return -EINVAL;
> 
> 	/* Verify that the area passed by the user is writeable */
>
>_______________________________________________
>Security mailing list
>Security@linux.kernel.org
>http://linux.kernel.org/mailman/listinfo/security
>
>----- End forwarded message -----
>
>-- 
>--
>  "Have you noticed the way people's intelligence capabilities decline
>   sharply the minute they start waving guns around?"
> 		-- Dr. Who
>_______________________________________________
>Vendor Security mailing list
>Vendor Security@lst.de
>https://www.lst.de/cgi-bin/mailman/listinfo/vendor-sec

Actions: View | Diff

Attachments on bug 71782: 31057 | 31060