[PATCH] fix unsigned issue with env_end - env_start

From: Chris Wright <chrisw@osdl.org>

Fix for CAN-2003-0462:  A race condition in the way env_start and
env_end pointers are initialized in the execve system call and used in
fs/proc/base.c on Linux 2.4 allows local users to cause a denial of
service (crash).

diff --git a/fs/proc/base.c b/fs/proc/base.c
index 9da127ff6c4ff812d2a930c6b494a4c5bfe10317..25eec04118047c4f4c7ea44558e7a9b2b1f0ab84 100644 (file)
--- a/fs/proc/base.c
+++ b/fs/proc/base.c
@@ -282,7 +282,7 @@ static int proc_pid_environ(struct task_struct *task, char * buffer)
        int res = 0;
        struct mm_struct *mm = get_task_mm(task);
        if (mm) {
-               int len = mm->env_end - mm->env_start;
+               unsigned int len = mm->env_end - mm->env_start;
                if (len > PAGE_SIZE)
                        len = PAGE_SIZE;
                res = access_process_vm(task, mm->env_start, buffer, len, 0);
@@ -294,7 +294,7 @@ static int proc_pid_environ(struct task_struct *task, char * buffer)
 static int proc_pid_cmdline(struct task_struct *task, char * buffer)
 {
        int res = 0;
-       int len;
+       unsigned int len;
        struct mm_struct *mm = get_task_mm(task);
        if (!mm)
                goto out;