This patches fixes a bug that is present in 2.1.115 at least. To demonstrate
log into another terminal and type
cat /dev/pts/666 (WARNNIG: this locks the terminal)
and you get an oops. Switiching to the other terminal shows that command
in disk waiting state, so you can not kill it. Worse it says there for all
time. If you discover that /dev/pts/666 does not exist and no panic your system
is not affected by the bug this patch fixes.
If your system is affected this patch will fix it. The bug is a simple lack
of bounds checking on the size of entry. If entry is too big (normally this
means >= 256) then sbi->inodes[] is memory that has not been allocated for
that purpose. After applying the patch the oops goes away and you discover
that /dev/pts/666 does not exist.
Since this is a kernel exploit fancy fireworks might hit your system, of course
if you are really unlucky. The patch assumes you are in the
/usr/src/linux/fs/devpts directory. This will probably get fixed "officially"
soon. (2.1.117 seems to be still affected).
BTW The only method of freeing up the process table entry used by that cat
command is rebooting. Bad guys could write a program that forks off processes
that exploit this bug and then exploits itself to tie process table entries,
obviously. That could be bad news.
--- linux/fs/devpts/root.c.dist Thu Aug 13 17:54:17 1998
+++ linux/fs/devpts/root.c Thu Aug 13 20:33:50 1998
@@ -159,10 +159,12 @@
entry += (*p++ - '0');
}
}
-
- dentry->d_inode = sbi->inodes[entry];
- if ( dentry->d_inode )
- dentry->d_inode->i_count++;
+ if (entry<sbi->max_ptys) /* Check range of number */
+ {
+ dentry->d_inode = sbi->inodes[entry];
+ if ( dentry->d_inode )
+ dentry->d_inode->i_count++;
+ }
d_add(dentry, dentry->d_inode);
-- Duncan (-: "software industry, the: unique industry where selling substandard goods is legal and you can charge extra for fixing the problems."
- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.rutgers.edu Please read the FAQ at http://www.tux.org/lkml/faq.html