From: Neil Horman Patch to add check to get_chrdev_list and get_blkdev_list to prevent reads of /proc/devices from spilling over the provided page if more than 4096 bytes of string data are generated from all the registered character and block devices in a system Signed-off-by: Neil Horman Cc: Christoph Hellwig Cc: Signed-off-by: Andrew Morton --- drivers/block/genhd.c | 12 ++++++++++-- fs/char_dev.c | 13 ++++++++++++- fs/proc/proc_misc.c | 2 +- include/linux/genhd.h | 2 +- 4 files changed, 24 insertions(+), 5 deletions(-) diff -puN drivers/block/genhd.c~add-check-to-proc-devices-read-routines drivers/block/genhd.c --- 25/drivers/block/genhd.c~add-check-to-proc-devices-read-routines 2005-05-09 20:09:32.000000000 -0700 +++ 25-akpm/drivers/block/genhd.c 2005-05-09 20:09:32.000000000 -0700 @@ -40,7 +40,7 @@ static inline int major_to_index(int maj #ifdef CONFIG_PROC_FS /* get block device names in somewhat random order */ -int get_blkdev_list(char *p) +int get_blkdev_list(char *p, int used) { struct blk_major_name *n; int i, len; @@ -49,10 +49,18 @@ int get_blkdev_list(char *p) down(&block_subsys_sem); for (i = 0; i < ARRAY_SIZE(major_names); i++) { - for (n = major_names[i]; n; n = n->next) + for (n = major_names[i]; n; n = n->next) { + /* + * If the curent string plus the 5 extra characters + * in the line would run us off the page, then we're done + */ + if ((len + used + strlen(n->name) + 5) >= PAGE_SIZE) + goto page_full; len += sprintf(p+len, "%3d %s\n", n->major, n->name); + } } +page_full: up(&block_subsys_sem); return len; diff -puN fs/char_dev.c~add-check-to-proc-devices-read-routines fs/char_dev.c --- 25/fs/char_dev.c~add-check-to-proc-devices-read-routines 2005-05-09 20:09:32.000000000 -0700 +++ 25-akpm/fs/char_dev.c 2005-05-09 20:09:32.000000000 -0700 @@ -56,10 +56,21 @@ int get_chrdev_list(char *page) down(&chrdevs_lock); for (i = 0; i < ARRAY_SIZE(chrdevs) ; i++) { - for (cd = chrdevs[i]; cd; cd = cd->next) + for (cd = chrdevs[i]; cd; cd = cd->next) { + /* + * if the current name, plus the 5 extra characters + * in the device line for this entry + * would run us off the page, we're done + */ + if ((len+strlen(cd->name) + 5) >= PAGE_SIZE) + goto page_full; + + len += sprintf(page+len, "%3d %s\n", cd->major, cd->name); + } } +page_full: up(&chrdevs_lock); return len; diff -puN fs/proc/proc_misc.c~add-check-to-proc-devices-read-routines fs/proc/proc_misc.c --- 25/fs/proc/proc_misc.c~add-check-to-proc-devices-read-routines 2005-05-09 20:09:32.000000000 -0700 +++ 25-akpm/fs/proc/proc_misc.c 2005-05-09 20:09:32.000000000 -0700 @@ -451,7 +451,7 @@ static int devices_read_proc(char *page, int count, int *eof, void *data) { int len = get_chrdev_list(page); - len += get_blkdev_list(page+len); + len += get_blkdev_list(page+len, len); return proc_calc_metrics(page, start, off, count, eof, len); } diff -puN include/linux/genhd.h~add-check-to-proc-devices-read-routines include/linux/genhd.h --- 25/include/linux/genhd.h~add-check-to-proc-devices-read-routines 2005-05-09 20:09:32.000000000 -0700 +++ 25-akpm/include/linux/genhd.h 2005-05-09 20:09:32.000000000 -0700 @@ -224,7 +224,7 @@ static inline void free_disk_stats(struc extern void disk_round_stats(struct gendisk *disk); /* drivers/block/genhd.c */ -extern int get_blkdev_list(char *); +extern int get_blkdev_list(char *, int); extern void add_disk(struct gendisk *disk); extern void del_gendisk(struct gendisk *gp); extern void unlink_gendisk(struct gendisk *gp); _