Re: [PATCH] splice: fix user pointer access in get_iovec_page_array()

2008-02-10 Thread Oliver Pinter
Linux pancs 2.6.22.17-opt2-cve2 #1 SMP Sun Feb 10 16:22:37 CET 2008 i686 GNU/Linux --- Linux vmsplice Local Root Exploit By qaaz --- [+] mmap: 0x0 .. 0x1000 [+] page: 0x0 [+] page: 0x20 [+] mmap: 0x4000 .. 0x5000 [+] page: 0x4000

Re: [PATCH] splice: fix user pointer access in get_iovec_page_array()

2008-02-10 Thread Willy Tarreau
On Sun, Feb 10, 2008 at 04:47:57PM +0200, Pekka J Enberg wrote: > From: Bastian Blank <[EMAIL PROTECTED]> > > The commit 8811930dc74a503415b35c4a79d14fb0b408a361 ("splice: missing user > pointer access verification") added access_ok() to copy_from_user_mmap_sem() > which only ensures we can copy

Re: [PATCH] splice: fix user pointer access in get_iovec_page_array()

2008-02-10 Thread Oliver Pinter
Signed-off-by: Oliver Pinter <[EMAIL PROTECTED]> 8< Linux pancs 2.6.22.17-opt2-cve2 #1 SMP Sun Feb 10 16:22:37 CET 2008 i686 GNU/Linux --- Linux vmsplice Local Root Exploit By qaaz --- [+] mmap: 0x0 .. 0x1000 [+] page: 0x0

Re: [PATCH] splice: fix user pointer access in get_iovec_page_array()

2008-02-10 Thread Bastian Blank
On Sun, Feb 10, 2008 at 04:47:57PM +0200, Pekka J Enberg wrote: > From: Bastian Blank <[EMAIL PROTECTED]> > > The commit 8811930dc74a503415b35c4a79d14fb0b408a361 ("splice: missing user > pointer access verification") added access_ok() to copy_from_user_mmap_sem() > which only ensures we can copy

[PATCH] splice: fix user pointer access in get_iovec_page_array()

2008-02-10 Thread Pekka J Enberg
From: Bastian Blank <[EMAIL PROTECTED]> The commit 8811930dc74a503415b35c4a79d14fb0b408a361 ("splice: missing user pointer access verification") added access_ok() to copy_from_user_mmap_sem() which only ensures we can copy the struct iovecs from userspace to the kernel but we also must check

Re: [PATCH] splice: fix user pointer access in get_iovec_page_array()

2008-02-10 Thread Bastian Blank
On Sun, Feb 10, 2008 at 04:47:57PM +0200, Pekka J Enberg wrote: From: Bastian Blank [EMAIL PROTECTED] The commit 8811930dc74a503415b35c4a79d14fb0b408a361 (splice: missing user pointer access verification) added access_ok() to copy_from_user_mmap_sem() which only ensures we can copy the

Re: [PATCH] splice: fix user pointer access in get_iovec_page_array()

2008-02-10 Thread Oliver Pinter
Signed-off-by: Oliver Pinter [EMAIL PROTECTED] 8 Linux pancs 2.6.22.17-opt2-cve2 #1 SMP Sun Feb 10 16:22:37 CET 2008 i686 GNU/Linux --- Linux vmsplice Local Root Exploit By qaaz --- [+] mmap: 0x0 .. 0x1000 [+] page: 0x0

Re: [PATCH] splice: fix user pointer access in get_iovec_page_array()

2008-02-10 Thread Willy Tarreau
On Sun, Feb 10, 2008 at 04:47:57PM +0200, Pekka J Enberg wrote: From: Bastian Blank [EMAIL PROTECTED] The commit 8811930dc74a503415b35c4a79d14fb0b408a361 (splice: missing user pointer access verification) added access_ok() to copy_from_user_mmap_sem() which only ensures we can copy the

Re: [PATCH] splice: fix user pointer access in get_iovec_page_array()

2008-02-10 Thread Oliver Pinter
Linux pancs 2.6.22.17-opt2-cve2 #1 SMP Sun Feb 10 16:22:37 CET 2008 i686 GNU/Linux --- Linux vmsplice Local Root Exploit By qaaz --- [+] mmap: 0x0 .. 0x1000 [+] page: 0x0 [+] page: 0x20 [+] mmap: 0x4000 .. 0x5000 [+] page: 0x4000