Commit f87dc66e authored by Prasanna Meda's avatar Prasanna Meda Committed by Linus Torvalds

[PATCH] unlocked access to task->comm

Looking at  get_task_comm patch:
http://linus.bkbits.net:8080/linux-2.5/patch@1.1803.144.3

There is one other place where task->comm is accessed outside current.
There are two issues.  The code is trying to copy to temp space without
task_lock.  It is not using temp space for actual user copy.

Cc: Ralf Baechle <ralf@linux-mips.org>
Signed-off-by: default avatarAndrew Morton <akpm@osdl.org>
Signed-off-by: default avatarLinus Torvalds <torvalds@osdl.org>
parent c82997bb
...@@ -287,9 +287,9 @@ asmlinkage int irix_syssgi(struct pt_regs *regs) ...@@ -287,9 +287,9 @@ asmlinkage int irix_syssgi(struct pt_regs *regs)
int pid = (int) regs->regs[base + 5]; int pid = (int) regs->regs[base + 5];
char *buf = (char *) regs->regs[base + 6]; char *buf = (char *) regs->regs[base + 6];
struct task_struct *p; struct task_struct *p;
char comm[16]; char tcomm[sizeof(current->comm)];
retval = verify_area(VERIFY_WRITE, buf, 16); retval = verify_area(VERIFY_WRITE, buf, sizeof(tcomm));
if (retval) if (retval)
break; break;
read_lock(&tasklist_lock); read_lock(&tasklist_lock);
...@@ -299,11 +299,11 @@ asmlinkage int irix_syssgi(struct pt_regs *regs) ...@@ -299,11 +299,11 @@ asmlinkage int irix_syssgi(struct pt_regs *regs)
retval = -ESRCH; retval = -ESRCH;
break; break;
} }
memcpy(comm, p->comm, 16); get_task_comm(tcomm, p);
read_unlock(&tasklist_lock); read_unlock(&tasklist_lock);
/* XXX Need to check sizes. */ /* XXX Need to check sizes. */
copy_to_user(buf, p->comm, 16); copy_to_user(buf, tcomm, sizeof(tcomm));
retval = 0; retval = 0;
break; break;
} }
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment