summaryrefslogtreecommitdiffstats
path: root/fs/proc
diff options
context:
space:
mode:
authorOleg Nesterov <oleg@redhat.com>2014-01-24 00:55:40 +0100
committerLinus Torvalds <torvalds@linux-foundation.org>2014-01-24 01:37:01 +0100
commit9f6e963f06c19a57a876cb77a9c87f6a56295b13 (patch)
treeed59763257b26d1faa606f582ccbfbec4a3cfafa /fs/proc
parentproc: don't (ab)use ->group_leader in proc_task_readdir() paths (diff)
downloadlinux-9f6e963f06c19a57a876cb77a9c87f6a56295b13.tar.xz
linux-9f6e963f06c19a57a876cb77a9c87f6a56295b13.zip
proc: fix ->f_pos overflows in first_tid()
1. proc_task_readdir()->first_tid() path truncates f_pos to int, this is wrong even on 64bit. We could check that f_pos < PID_MAX or even INT_MAX in proc_task_readdir(), but this patch simply checks the potential overflow in first_tid(), this check is nop on 64bit. We do not care if it was negative and the new unsigned value is huge, all we need to ensure is that we never wrongly return !NULL. 2. Remove the 2nd "nr != 0" check before get_nr_threads(), nr_threads == 0 is not distinguishable from !pid_task() above. Signed-off-by: Oleg Nesterov <oleg@redhat.com> Cc: "Eric W. Biederman" <ebiederm@xmission.com> Cc: Michal Hocko <mhocko@suse.cz> Cc: Sameer Nanda <snanda@chromium.org> Cc: Sergey Dyasly <dserrg@gmail.com> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Diffstat (limited to 'fs/proc')
-rw-r--r--fs/proc/base.c14
1 files changed, 9 insertions, 5 deletions
diff --git a/fs/proc/base.c b/fs/proc/base.c
index 9b423fec9732..51507065263b 100644
--- a/fs/proc/base.c
+++ b/fs/proc/base.c
@@ -3097,10 +3097,14 @@ out_no_task:
* In the case of a seek we start with the leader and walk nr
* threads past it.
*/
-static struct task_struct *first_tid(struct pid *pid, int tid,
- int nr, struct pid_namespace *ns)
+static struct task_struct *first_tid(struct pid *pid, int tid, loff_t f_pos,
+ struct pid_namespace *ns)
{
struct task_struct *pos, *task;
+ unsigned long nr = f_pos;
+
+ if (nr != f_pos) /* 32bit overflow? */
+ return NULL;
rcu_read_lock();
task = pid_task(pid, PIDTYPE_PID);
@@ -3108,14 +3112,14 @@ static struct task_struct *first_tid(struct pid *pid, int tid,
goto fail;
/* Attempt to start with the tid of a thread */
- if (tid && (nr > 0)) {
+ if (tid && nr) {
pos = find_task_by_pid_ns(tid, ns);
if (pos && same_thread_group(pos, task))
goto found;
}
/* If nr exceeds the number of threads there is nothing todo */
- if (nr && nr >= get_nr_threads(task))
+ if (nr >= get_nr_threads(task))
goto fail;
/* If we haven't found our starting place yet start
@@ -3123,7 +3127,7 @@ static struct task_struct *first_tid(struct pid *pid, int tid,
*/
pos = task = task->group_leader;
do {
- if (nr-- <= 0)
+ if (!nr--)
goto found;
} while_each_thread(task, pos);
fail: