1. 29 8月, 2005 20 次提交
  2. 28 8月, 2005 1 次提交
    • A
      [PATCH] mmaper_kern.c fixes [buffer overruns] · 6a029a90
      Al Viro 提交于
       - copy_from_user() can fail; ->write() must check its return value.
      
       - severe buffer overruns both in ->read() and ->write() - lseek to the
         end (i.e.  to mmapper_size) and
      
      	if (count + *ppos > mmapper_size)
      		count = count + *ppos - mmapper_size;
      
         will do absolutely nothing.  Then it will call
      
      	copy_to_user(buf,&v_buf[*ppos],count);
      
         with obvious results (similar for ->write()).
      
         Fixed by turning read to simple_read_from_buffer() and by doing
         normal limiting of count in ->write().
      
       - gratitious lock_kernel() in ->mmap() - it's useless there.
      
       - lots of gratuitous includes.
      Signed-off-by: NAl Viro <viro@parcelfarce.linux.theplanet.co.uk>
      Signed-off-by: NLinus Torvalds <torvalds@osdl.org>
      6a029a90
  3. 27 8月, 2005 3 次提交
  4. 25 8月, 2005 3 次提交
  5. 24 8月, 2005 13 次提交