Re: [PATCHv6] SGI UV: TLB shootdown using broadcast assist unit -v6 delta

[Ingo Molnar]

* Cliff Wickman <cpw@xxxxxxx> wrote:

>   > Found a potential security hole while doing that:
>   > static ssize_t uv_ptc_proc_write(struct file *file, const char __user *user,
>   >                              size_t count, loff_t *data)
>   >     if (copy_from_user(optstr, user, count))
>   >             return -EFAULT;
>   >
>   > is count guaranteed to never be larger than 64?
>  is fixed below.

applied to tip/x86/uv, thanks Cliff.

>  It adds tlb_uv.o to the Makefile.

hm, it was already there in tip/master, so i left this bit out.

>  	char optstr[64];
>  
> +	if (count > 64)
> +		return -EINVAL;

also, this should not be in /proc, but be moved to debugfs. See 
arch/x86/mm/dump_pagetables.c about how to interface to debugfs.

And the "64" value should become something like:

	static const int max_option_len = 64;

or so.

	Ingo
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/