Commit 767b68e9 authored Sep 22, 2010 by Dan Rosenberg Committed by Linus Torvalds Sep 22, 2010

Prevent freeing uninitialized pointer in compat_do_readv_writev



In 32-bit compatibility mode, the error handling for
compat_do_readv_writev() may free an uninitialized pointer, potentially
leading to all sorts of ugly memory corruption.  This is reliably
triggerable by unprivileged users by invoking the readv()/writev()
syscalls with an invalid iovec pointer.  The below patch fixes this to
emulate the non-compat version.

Introduced by commit b8373363 ("compat: factor out
compat_rw_copy_check_uvector from compat_do_readv_writev")

Signed-off-by: Dan Rosenberg <dan.j.rosenberg@gmail.com>
Cc: stable@kernel.org (2.6.35)
Cc: Al Viro <viro@zeniv.linux.org.uk>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

parent c79bd892

fs/compat.c

+1 −1

Original line number	Diff line number	Diff line
		@@ -1153,7 +1153,7 @@ static ssize_t compat_do_readv_writev(int type, struct file *file,
		{
		compat_ssize_t tot_len;
		struct iovec iovstack[UIO_FASTIOV];
		struct iovec *iov;
		struct iovec *iov = iovstack;
		ssize_t ret;
		io_fn_t fn;
		iov_fn_t fnv;

Admin message