diff options
| author | Al Viro <viro@ftp.linux.org.uk> | 2010-09-20 15:13:09 +0100 |
|---|---|---|
| committer | Linus Torvalds <torvalds@linux-foundation.org> | 2010-09-20 10:44:37 -0700 |
| commit | 5f4ad04a1e805d14de080ff9d5384b4d20518a9a (patch) | |
| tree | 63252b79b48b7dfd29d9a8081a34c858dab1de74 /mm/shmem.c | |
| parent | 20cd514d0f3d288d968217028ca67b70e707d896 (diff) | |
| download | linux-5f4ad04a1e805d14de080ff9d5384b4d20518a9a.tar.bz2 | |
frv: fix address verification holes in setup_frame/setup_rt_frame
a) sa_handler might be maliciously set to point to kernel memory;
blindly dereferencing it in FDPIC case is a Bad Idea(tm).
b) I'm not sure you need that set_fs(USER_DS) there at all, but if you
do, you'd better do it *before* checking the frame you've decided to
use with access_ok(), lest sigaltstack() becomes a convenient
roothole.
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
Signed-off-by: David Howells <dhowells@redhat.com>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Diffstat (limited to 'mm/shmem.c')
0 files changed, 0 insertions, 0 deletions