mirror of
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/
synced 2026-09-16 18:15:52 +00:00
6a029a90f5
- copy_from_user() can fail; ->write() must check its return value. - severe buffer overruns both in ->read() and ->write() - lseek to the end (i.e. to mmapper_size) and if (count + *ppos > mmapper_size) count = count + *ppos - mmapper_size; will do absolutely nothing. Then it will call copy_to_user(buf,&v_buf[*ppos],count); with obvious results (similar for ->write()). Fixed by turning read to simple_read_from_buffer() and by doing normal limiting of count in ->write(). - gratitious lock_kernel() in ->mmap() - it's useless there. - lots of gratuitous includes. Signed-off-by: Al Viro <viro@parcelfarce.linux.theplanet.co.uk> Signed-off-by: Linus Torvalds <torvalds@osdl.org> |
History
|
|
|---|---|---|
| .. | ||
| alpha | ||
| arm | ||
| arm26 | ||
| cris | ||
| frv | ||
| h8300 | ||
| i386 | ||
| ia64 | ||
| m32r | ||
| m68k | ||
| m68knommu | ||
| mips | ||
| parisc | ||
| ppc | ||
| ppc64 | ||
| s390 | ||
| sh | ||
| sh64 | ||
| sparc | ||
| sparc64 | ||
| um | ||
| v850 | ||
| x86_64 | ||
| xtensa | ||