[SCM] systemtap: system-wide probe/trace tool branch, master, updated. release-0.9.9-228-gd0822e2

[Dave Brolley]

Mark Wielaard wrote:
> Hi Dave,
> I was looking at this piece:
>
> +lookup_bad_addr(unsigned long addr, size_t size)
>  {
>    struct addr_map_entry* result = 0;
> +
> +#ifndef STP_PRIVILEGED
> +  /* Unprivileged users must not access kernel space memory.  */
> +  if (addr + size > TASK_SIZE)
> +    return 1;
> +#endif
> +
>
> I was wondering if that check cannot "overflow" if size is really big,
> making addr + size > TASK_SIZE succeed because the computation wraps
> around making is smaller than TASK_SIZE.
>   
Right you are. As well as all the other range calculations performed 
later. I think this is best handled by a single range check before 
anything else is done. I've pushed the attached patch.

Thanks for catching this,
Dave

-------------- next part --------------
An embedded and charset-unspecified text was scrubbed...
Name: 10577-2.patch.txt
URL: <http://sourceware.org/pipermail/systemtap/attachments/20090904/aa2aaf81/attachment.txt>