This bug is missing log files that will aid in diagnosing the problem.
While running an Ubuntu kernel (not a mainline or third-party kernel)
please enter the following command in a terminal window:
apport-collect 1951927
and then change the status of the bug to 'Confirmed'.
If, due to the nature of the issue you have encountered, you are unable
to run this command, please add a comment stating that fact and change
the bug status to 'Confirmed'.
This change has been made by an automated script, maintained by the
Ubuntu Kernel Team.
** Changed in: linux (Ubuntu)
Status: New => Incomplete
--
You received this bug notification because you are a member of Kernel
Packages, which is subscribed to linux in Ubuntu.
https://bugs.launchpad.net/bugs/1951927
Title:
Array overflow in au_procfs_plm_write
Status in linux package in Ubuntu:
Incomplete
Bug description:
There is an simple array overflow when count = 20 in
au_procfs_plm_write.
static ssize_t au_procfs_plm_write(struct file *file, const char __user *ubuf,
size_t count, loff_t *ppos)
{
...
char buf[3 + sizeof(unsigned long) * 2 + 1];
err = -EACCES;
if (unlikely(!capable(CAP_SYS_ADMIN)))
goto out;
err = -EINVAL;
if (unlikely(count > sizeof(buf)))
goto out;
err = copy_from_user(buf, ubuf, count);
if (unlikely(err)) {
err = -EFAULT;
goto out;
}
buf[count] = 0; <----here
...
}
My suggestion for the patch is:
static ssize_t au_procfs_plm_write(struct file *file, const char __user *ubuf,
size_t count, loff_t *ppos)
{
...
char buf[3 + sizeof(unsigned long) * 2 + 1];
err = -EACCES;
if (unlikely(!capable(CAP_SYS_ADMIN)))
goto out;
err = -EINVAL;
if (unlikely(count > sizeof(buf)))
goto out;
err = copy_from_user(buf, ubuf, count);
if (unlikely(err)) {
err = -EFAULT;
goto out;
}
--- buf[count] = 0;
+++ buf[count - 1] = 0;
...
}
To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/linux/+bug/1951927/+subscriptions
--
Mailing list: https://launchpad.net/~kernel-packages
Post to : kernel-packages@lists.launchpad.net
Unsubscribe : https://launchpad.net/~kernel-packages
More help : https://help.launchpad.net/ListHelp
