diff options
| author | Dan Rosenberg <drosenberg@vsecurity.com> | 2010-09-22 14:32:56 -0400 |
|---|---|---|
| committer | Linus Torvalds <torvalds@linux-foundation.org> | 2010-09-22 20:22:38 -0400 |
| commit | 767b68e96993e29e3480d7ecdd9c4b84667c5762 (patch) | |
| tree | d450dcf7832f0ec22f7371a9da7f3ab8be4ad875 /lib/debug_locks.c | |
| parent | c79bd89282136a4516e842fa542d6abf902ddeac (diff) | |
Prevent freeing uninitialized pointer in compat_do_readv_writev
In 32-bit compatibility mode, the error handling for
compat_do_readv_writev() may free an uninitialized pointer, potentially
leading to all sorts of ugly memory corruption. This is reliably
triggerable by unprivileged users by invoking the readv()/writev()
syscalls with an invalid iovec pointer. The below patch fixes this to
emulate the non-compat version.
Introduced by commit b83733639a49 ("compat: factor out
compat_rw_copy_check_uvector from compat_do_readv_writev")
Signed-off-by: Dan Rosenberg <dan.j.rosenberg@gmail.com>
Cc: stable@kernel.org (2.6.35)
Cc: Al Viro <viro@zeniv.linux.org.uk>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Diffstat (limited to 'lib/debug_locks.c')
0 files changed, 0 insertions, 0 deletions