6a029a90f5
- copy_from_user() can fail; ->write() must check its return value. - severe buffer overruns both in ->read() and ->write() - lseek to the end (i.e. to mmapper_size) and if (count + *ppos > mmapper_size) count = count + *ppos - mmapper_size; will do absolutely nothing. Then it will call copy_to_user(buf,&v_buf[*ppos],count); with obvious results (similar for ->write()). Fixed by turning read to simple_read_from_buffer() and by doing normal limiting of count in ->write(). - gratitious lock_kernel() in ->mmap() - it's useless there. - lots of gratuitous includes. Signed-off-by: Al Viro <viro@parcelfarce.linux.theplanet.co.uk> Signed-off-by: Linus Torvalds <torvalds@osdl.org> |
||
---|---|---|
.. | ||
chan_kern.c | ||
chan_user.c | ||
cow_sys.h | ||
cow_user.c | ||
cow.h | ||
daemon_kern.c | ||
daemon_user.c | ||
daemon.h | ||
fd.c | ||
harddog_kern.c | ||
harddog_user.c | ||
hostaudio_kern.c | ||
line.c | ||
Makefile | ||
mcast_kern.c | ||
mcast_user.c | ||
mcast.h | ||
mconsole_kern.c | ||
mconsole_user.c | ||
mmapper_kern.c | ||
net_kern.c | ||
net_user.c | ||
null.c | ||
pcap_kern.c | ||
pcap_user.c | ||
pcap_user.h | ||
port_kern.c | ||
port_user.c | ||
port.h | ||
pty.c | ||
random.c | ||
slip_common.c | ||
slip_common.h | ||
slip_kern.c | ||
slip_user.c | ||
slip.h | ||
slirp_kern.c | ||
slirp_user.c | ||
slirp.h | ||
ssl.c | ||
ssl.h | ||
stderr_console.c | ||
stdio_console.c | ||
stdio_console.h | ||
tty.c | ||
ubd_kern.c | ||
ubd_user.c | ||
xterm_kern.c | ||
xterm.c | ||
xterm.h |