2005-05-20 05:33:22

by Vasily Averin

[permalink] [raw]

Subject: [PATCH 2.4] random poolsize sysctl fix

---

--- ./drivers/char/random.c.rndps Wed Jan 19 17:09:48 2005
+++ ./drivers/char/random.c Fri May 20 09:09:18 2005
@@ -1771,7 +1771,7 @@ static int change_poolsize(int poolsize)
static int proc_do_poolsize(ctl_table *table, int write, struct file *filp,
void *buffer, size_t *lenp)
{
- unsigned int ret;
+ int ret;

sysctl_poolsize = random_state->poolinfo.POOLBYTES;

@@ -1787,7 +1787,7 @@ static int poolsize_strategy(ctl_table *
void *oldval, size_t *oldlenp,
void *newval, size_t newlen, void **context)
{
- int len;
+ unsigned int len;

sysctl_poolsize = random_state->poolinfo.POOLBYTES;

---

Attachments:

diff-security-rndpoolsize-20050520 (630.00 B)

2005-05-20 16:11:58

by Marcelo Tosatti

[permalink] [raw]

Subject: Re: [PATCH 2.4] random poolsize sysctl fix

---

Hi Vasily,

On Fri, May 20, 2005 at 09:32:48AM +0400, Vasily Averin wrote:
> Hello Marcelo,
>
> SWSoft Linux kernel Team has discovered that your patch
> http://linux.bkbits.net:8080/linux-2.4/gnupatch@41e2c4fetTJmVti-Xxql21xXjfbpag
> which should fix a random poolsize sysctl handler integer overflow, is
> wrong.
> You have changed a variable definition in function proc_do_poolsize(),
> but you had to fix an another function, poolsize_strategy()

Ouch. Shame on me.

Recent v2.4 versions aren't vulnerable, at least on i386, where copy_from_user()
does signed overflow checking.

Patch applied, thanks.

> --- ./drivers/char/random.c.rndps Wed Jan 19 17:09:48 2005
> +++ ./drivers/char/random.c Fri May 20 09:09:18 2005
> @@ -1771,7 +1771,7 @@ static int change_poolsize(int poolsize)
> static int proc_do_poolsize(ctl_table *table, int write, struct file *filp,
> void *buffer, size_t *lenp)
> {
> - unsigned int ret;
> + int ret;
>
> sysctl_poolsize = random_state->poolinfo.POOLBYTES;
>
> @@ -1787,7 +1787,7 @@ static int poolsize_strategy(ctl_table *
> void *oldval, size_t *oldlenp,
> void *newval, size_t newlen, void **context)
> {
> - int len;
> + unsigned int len;
>
> sysctl_poolsize = random_state->poolinfo.POOLBYTES;
>