Because the pread and pwrite functions do not respect the unsigned offset flag, you can read certain parts of /proc/$pid/mem via lseek() and read(), but not via pread(). (This probably went unnoticed because on i386 and x86-64, almost everything except the vdso is normally located below the region where signed offsets become negative: but this is not true on all platforms.)
Fixing pwrite() is currently academic because this flag is only used by files that do not allow writing, but it is easiest to be consistent and retain a similarity of form between the pread*() and pwrite*() functions. Signed-off-by: Nick Alcock <[email protected]> --- fs/read_write.c | 22 +++++++++++++++------- 1 file changed, 15 insertions(+), 7 deletions(-) diff --git a/fs/read_write.c b/fs/read_write.c index 58e440d..f33f664 100644 --- a/fs/read_write.c +++ b/fs/read_write.c @@ -534,10 +534,12 @@ SYSCALL_DEFINE4(pread64, unsigned int, fd, char __user *, buf, struct fd f; ssize_t ret = -EBADF; - if (pos < 0) + f = fdget(fd); + if ((pos < 0) && (!f.file || !unsigned_offsets(f.file))) { + fdput(f); return -EINVAL; + } - f = fdget(fd); if (f.file) { ret = -ESPIPE; if (f.file->f_mode & FMODE_PREAD) @@ -554,10 +556,12 @@ SYSCALL_DEFINE4(pwrite64, unsigned int, fd, const char __user *, buf, struct fd f; ssize_t ret = -EBADF; - if (pos < 0) + f = fdget(fd); + if ((pos < 0) && (!f.file || !unsigned_offsets(f.file))) { + fdput(f); return -EINVAL; + } - f = fdget(fd); if (f.file) { ret = -ESPIPE; if (f.file->f_mode & FMODE_PWRITE) @@ -847,10 +851,12 @@ SYSCALL_DEFINE5(preadv, unsigned long, fd, const struct iovec __user *, vec, struct fd f; ssize_t ret = -EBADF; - if (pos < 0) + f = fdget(fd); + if ((pos < 0) && (!f.file || !unsigned_offsets(f.file))) { + fdput(f); return -EINVAL; + } - f = fdget(fd); if (f.file) { ret = -ESPIPE; if (f.file->f_mode & FMODE_PREAD) @@ -871,8 +877,10 @@ SYSCALL_DEFINE5(pwritev, unsigned long, fd, const struct iovec __user *, vec, struct fd f; ssize_t ret = -EBADF; - if (pos < 0) + if ((pos < 0) && (!f.file || !unsigned_offsets(f.file))) { + f = fdget(fd); return -EINVAL; + } f = fdget(fd); if (f.file) { -- 1.8.5.2.169.ge058798 -- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to [email protected] More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/
