aboutsummaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authorDan Rosenberg <drosenberg@vsecurity.com>2010-09-22 14:32:56 -0400
committerLinus Torvalds <torvalds@linux-foundation.org>2010-09-22 17:22:38 -0700
commit767b68e96993e29e3480d7ecdd9c4b84667c5762 (patch)
treed450dcf7832f0ec22f7371a9da7f3ab8be4ad875
parentc79bd89282136a4516e842fa542d6abf902ddeac (diff)
downloadmrst-s0i3-test-767b68e96993e29e3480d7ecdd9c4b84667c5762.tar.gz
mrst-s0i3-test-767b68e96993e29e3480d7ecdd9c4b84667c5762.tar.xz
mrst-s0i3-test-767b68e96993e29e3480d7ecdd9c4b84667c5762.zip
Prevent freeing uninitialized pointer in compat_do_readv_writev
In 32-bit compatibility mode, the error handling for compat_do_readv_writev() may free an uninitialized pointer, potentially leading to all sorts of ugly memory corruption. This is reliably triggerable by unprivileged users by invoking the readv()/writev() syscalls with an invalid iovec pointer. The below patch fixes this to emulate the non-compat version. Introduced by commit b83733639a49 ("compat: factor out compat_rw_copy_check_uvector from compat_do_readv_writev") Signed-off-by: Dan Rosenberg <dan.j.rosenberg@gmail.com> Cc: stable@kernel.org (2.6.35) Cc: Al Viro <viro@zeniv.linux.org.uk> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
-rw-r--r--fs/compat.c2
1 files changed, 1 insertions, 1 deletions
diff --git a/fs/compat.c b/fs/compat.c
index 718c7062aec..0644a154672 100644
--- a/fs/compat.c
+++ b/fs/compat.c
@@ -1153,7 +1153,7 @@ static ssize_t compat_do_readv_writev(int type, struct file *file,
{
compat_ssize_t tot_len;
struct iovec iovstack[UIO_FASTIOV];
- struct iovec *iov;
+ struct iovec *iov = iovstack;
ssize_t ret;
io_fn_t fn;
iov_fn_t fnv;