Skip to content

K
kernel_linux

OpenHarmony / kernel_linux
上一次同步 3 年多

通知 13
Star 8
Fork 2
K
kernel_linux
切换分支/标签
  1. 15 5月, 2008 1 次提交
  3. 01 5月, 2008 1 次提交
    • B
      sysfs: Disallow truncation of files in sysfs · 40a2159a
      由 Ben Hutchings 提交于 
      sysfs allows attribute files to be truncated, e.g. using ftruncate(), with the
expected effect on their inode.   For most attributes, this doesn't change the
"real" size of the file i.e. how much can be read from it.  However, the
parameter validation for reading and writing binary attribute files is based
on the inode size and not the size specified in the file's bin_attribute, so it
can be broken by this. For example, if we try using dd to write to such a file:

# pwd
/sys/bus/pci/devices/0000:08:00.0
# ls -l config
-rw-r--r--  1 root root 4096 Feb  1 17:35 config
# dd if=/dev/zero of=config bs=4 count=1
1+0 records in
1+0 records out
# ls -l config
-rw-r--r--  1 root root 0 Feb  1 17:50 config
# dd if=/dev/zero of=config bs=4 count=1 seek=128
dd: writing `config': No space left on device
1+0 records in
0+0 records out

Also, after truncation to 0, parameter validation for read and write is
disabled.  Most bin_attribute read and write methods also validate the size and
offset, but for some this will allow out-of-range access.  This may be a
security issue, though access to such files is often limited to root.  In any
case, the validation should remain for safety's sake!)

This was previously reported in Bugzilla as bug 9867.

sysfs should ignore size changes or else refuse them (by returning -EINVAL).
This patch makes it ignore them.
Signed-off-by: NBen Hutchings <bhutchings@solarflare.com>
Signed-off-by: NGreg Kroah-Hartman <gregkh@suse.de>
      40a2159a
  5. 30 4月, 2008 2 次提交
  7. 23 4月, 2008 1 次提交
  9. 20 4月, 2008 2 次提交
  11. 18 4月, 2008 1 次提交
  13. 25 3月, 2008 1 次提交
  15. 08 2月, 2008 1 次提交
    • G
      sysfs: remove BUG_ON() from sysfs_remove_group() · 969affd2
      由 Greg Kroah-Hartman 提交于 
      It's possible that the caller of sysfs_remove_group messed up and passed in an attribute group that was not really registered to this kobject.  But don't panic for such a foolish error, spit out a warning about what happened, and continue on our way safely.

Cc: Roland Dreier <rdreier@cisco.com>
Cc: Tejun Heo <htejun@gmail.com>
Signed-off-by: NGreg Kroah-Hartman <gregkh@suse.de>
      969affd2
  17. 25 1月, 2008 5 次提交
  19. 24 1月, 2008 2 次提交
  21. 17 1月, 2008 2 次提交
  23. 29 11月, 2007 1 次提交
    • M
      sysfs: fix off-by-one error in fill_read_buffer() · 8118a859
      由 Miao Xie 提交于 
      I found that there is a off-by-one problem in the following code.

Version:	2.6.24-rc2
File:		fs/sysfs/file.c:118-122
Function:	fill_read_buffer
--------------------------------------------------------------------
	count = ops->show(kobj, attr_sd->s_attr.attr, buffer->page);

	sysfs_put_active_two(attr_sd);

	BUG_ON(count > (ssize_t)PAGE_SIZE);
--------------------------------------------------------------------

Because according to the specification of the sysfs and the implement of
the show methods, the show methods return the number of bytes which would
be generated for the given input, excluding the trailing null.So if the
return value of the show methods equals PAGE_SIZE - 1, the buffer is full
in fact.  And if the return value equals PAGE_SIZE, the resulting string
was already truncated,or buffer overflow occurred.

This patch fixes an off-by-one error in fill_read_buffer.
Signed-off-by: NMiao Xie <miaox@cn.fujitsu.com>
Signed-off-by: NAndrew Morton <akpm@linux-foundation.org>
Acked-by: NTejun Heo <teheo@suse.de>
Signed-off-by: NGreg Kroah-Hartman <gregkh@suse.de>
      8118a859
  25. 31 10月, 2007 1 次提交
  27. 20 10月, 2007 1 次提交
  29. 17 10月, 2007 4 次提交
  31. 13 10月, 2007 14 次提交