6a029a90f5
- copy_from_user() can fail; ->write() must check its return value. - severe buffer overruns both in ->read() and ->write() - lseek to the end (i.e. to mmapper_size) and if (count + *ppos > mmapper_size) count = count + *ppos - mmapper_size; will do absolutely nothing. Then it will call copy_to_user(buf,&v_buf[*ppos],count); with obvious results (similar for ->write()). Fixed by turning read to simple_read_from_buffer() and by doing normal limiting of count in ->write(). - gratitious lock_kernel() in ->mmap() - it's useless there. - lots of gratuitous includes. Signed-off-by: Al Viro <viro@parcelfarce.linux.theplanet.co.uk> Signed-off-by: Linus Torvalds <torvalds@osdl.org> |
||
|---|---|---|
| .. | ||
| Makefile | ||
| chan_kern.c | ||
| chan_user.c | ||
| cow.h | ||
| cow_sys.h | ||
| cow_user.c | ||
| daemon.h | ||
| daemon_kern.c | ||
| daemon_user.c | ||
| fd.c | ||
| harddog_kern.c | ||
| harddog_user.c | ||
| hostaudio_kern.c | ||
| line.c | ||
| mcast.h | ||
| mcast_kern.c | ||
| mcast_user.c | ||
| mconsole_kern.c | ||
| mconsole_user.c | ||
| mmapper_kern.c | ||
| net_kern.c | ||
| net_user.c | ||
| null.c | ||
| pcap_kern.c | ||
| pcap_user.c | ||
| pcap_user.h | ||
| port.h | ||
| port_kern.c | ||
| port_user.c | ||
| pty.c | ||
| random.c | ||
| slip.h | ||
| slip_common.c | ||
| slip_common.h | ||
| slip_kern.c | ||
| slip_user.c | ||
| slirp.h | ||
| slirp_kern.c | ||
| slirp_user.c | ||
| ssl.c | ||
| ssl.h | ||
| stderr_console.c | ||
| stdio_console.c | ||
| stdio_console.h | ||
| tty.c | ||
| ubd_kern.c | ||
| ubd_user.c | ||
| xterm.c | ||
| xterm.h | ||
| xterm_kern.c | ||