* [PATCH 1/2] hugetlb, sysctl: pass '.extra1 = NULL' rather then '.extra1 = &zero' [not found] <548CA6B6.3060901@colorfullife.com> @ 2014-12-17 14:30 ` Andrey Ryabinin 2014-12-17 14:30 ` [PATCH 2/2] mm: hugetlb: fix type of hugetlb_treat_as_movable variable Andrey Ryabinin 2014-12-18 0:38 ` [PATCH 1/2] hugetlb, sysctl: pass '.extra1 = NULL' rather then '.extra1 = &zero' David Rientjes 0 siblings, 2 replies; 4+ messages in thread From: Andrey Ryabinin @ 2014-12-17 14:30 UTC (permalink / raw) To: akpm Cc: Andrey Ryabinin, Dmitry Vyukov, Manfred Spraul, David Rientjes, Naoya Horiguchi, Luiz Capitulino, Kirill A. Shutemov, nadia.derbey@bull.net, aquini, Joe Perches, avagin, LKML, Kostya Serebryany, Dmitry Chernenkov, Andrey Konovalov, Konstantin Khlebnikov, kasan-dev, Davidlohr Bueso, linux-mm Commit ed4d4902ebdd ("mm, hugetlb: remove hugetlb_zero and hugetlb_infinity") replaced 'unsigned long hugetlb_zero' with 'int zero' leading to out-of-bounds access in proc_doulongvec_minmax(). Use '.extra1 = NULL' instead of '.extra1 = &zero'. Passing NULL is equivalent to passing minimal value, which is 0 for unsigned types. Reported-by: Dmitry Vyukov <dvyukov@google.com> Suggested-by: Manfred Spraul <manfred@colorfullife.com> Fixes: ed4d4902ebdd ("mm, hugetlb: remove hugetlb_zero and hugetlb_infinity") Signed-off-by: Andrey Ryabinin <a.ryabinin@samsung.com> --- kernel/sysctl.c | 3 --- 1 file changed, 3 deletions(-) diff --git a/kernel/sysctl.c b/kernel/sysctl.c index 137c7f6..88ea2d6 100644 --- a/kernel/sysctl.c +++ b/kernel/sysctl.c @@ -1248,7 +1248,6 @@ static struct ctl_table vm_table[] = { .maxlen = sizeof(unsigned long), .mode = 0644, .proc_handler = hugetlb_sysctl_handler, - .extra1 = &zero, }, #ifdef CONFIG_NUMA { @@ -1257,7 +1256,6 @@ static struct ctl_table vm_table[] = { .maxlen = sizeof(unsigned long), .mode = 0644, .proc_handler = &hugetlb_mempolicy_sysctl_handler, - .extra1 = &zero, }, #endif { @@ -1280,7 +1278,6 @@ static struct ctl_table vm_table[] = { .maxlen = sizeof(unsigned long), .mode = 0644, .proc_handler = hugetlb_overcommit_handler, - .extra1 = &zero, }, #endif { -- 2.2.0 -- To unsubscribe, send a message with 'unsubscribe linux-mm' in the body to majordomo@kvack.org. For more info on Linux MM, see: http://www.linux-mm.org/ . Don't email: <a href=mailto:"dont@kvack.org"> email@kvack.org </a> ^ permalink raw reply [flat|nested] 4+ messages in thread
* [PATCH 2/2] mm: hugetlb: fix type of hugetlb_treat_as_movable variable 2014-12-17 14:30 ` [PATCH 1/2] hugetlb, sysctl: pass '.extra1 = NULL' rather then '.extra1 = &zero' Andrey Ryabinin @ 2014-12-17 14:30 ` Andrey Ryabinin 2014-12-18 0:39 ` David Rientjes 2014-12-18 0:38 ` [PATCH 1/2] hugetlb, sysctl: pass '.extra1 = NULL' rather then '.extra1 = &zero' David Rientjes 1 sibling, 1 reply; 4+ messages in thread From: Andrey Ryabinin @ 2014-12-17 14:30 UTC (permalink / raw) To: akpm Cc: Andrey Ryabinin, Dmitry Vyukov, Manfred Spraul, David Rientjes, Naoya Horiguchi, Luiz Capitulino, Kirill A. Shutemov, nadia.derbey@bull.net, aquini, Joe Perches, avagin, LKML, Kostya Serebryany, Dmitry Chernenkov, Andrey Konovalov, Konstantin Khlebnikov, kasan-dev, Davidlohr Bueso, linux-mm hugetlb_treat_as_movable declared as unsigned long, but proc_dointvec() used for parsing it: static struct ctl_table vm_table[] = { ... { .procname = "hugepages_treat_as_movable", .data = &hugepages_treat_as_movable, .maxlen = sizeof(int), .mode = 0644, .proc_handler = proc_dointvec, }, This seems harmless, but it's better to use int type here. Signed-off-by: Andrey Ryabinin <a.ryabinin@samsung.com> --- include/linux/hugetlb.h | 2 +- mm/hugetlb.c | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/include/linux/hugetlb.h b/include/linux/hugetlb.h index 431b7fc..7d78563 100644 --- a/include/linux/hugetlb.h +++ b/include/linux/hugetlb.h @@ -86,7 +86,7 @@ void free_huge_page(struct page *page); pte_t *huge_pmd_share(struct mm_struct *mm, unsigned long addr, pud_t *pud); #endif -extern unsigned long hugepages_treat_as_movable; +extern int hugepages_treat_as_movable; extern int sysctl_hugetlb_shm_group; extern struct list_head huge_boot_pages; diff --git a/mm/hugetlb.c b/mm/hugetlb.c index 85032de..be0e5d0 100644 --- a/mm/hugetlb.c +++ b/mm/hugetlb.c @@ -35,7 +35,7 @@ #include <linux/node.h> #include "internal.h" -unsigned long hugepages_treat_as_movable; +int hugepages_treat_as_movable; int hugetlb_max_hstate __read_mostly; unsigned int default_hstate_idx; -- 2.2.0 -- To unsubscribe, send a message with 'unsubscribe linux-mm' in the body to majordomo@kvack.org. For more info on Linux MM, see: http://www.linux-mm.org/ . Don't email: <a href=mailto:"dont@kvack.org"> email@kvack.org </a> ^ permalink raw reply [flat|nested] 4+ messages in thread
* Re: [PATCH 2/2] mm: hugetlb: fix type of hugetlb_treat_as_movable variable 2014-12-17 14:30 ` [PATCH 2/2] mm: hugetlb: fix type of hugetlb_treat_as_movable variable Andrey Ryabinin @ 2014-12-18 0:39 ` David Rientjes 0 siblings, 0 replies; 4+ messages in thread From: David Rientjes @ 2014-12-18 0:39 UTC (permalink / raw) To: Andrey Ryabinin Cc: akpm, Dmitry Vyukov, Manfred Spraul, Naoya Horiguchi, Luiz Capitulino, Kirill A. Shutemov, nadia.derbey@bull.net, aquini, Joe Perches, avagin, LKML, Kostya Serebryany, Dmitry Chernenkov, Andrey Konovalov, Konstantin Khlebnikov, kasan-dev, Davidlohr Bueso, linux-mm On Wed, 17 Dec 2014, Andrey Ryabinin wrote: > hugetlb_treat_as_movable declared as unsigned long, but > proc_dointvec() used for parsing it: > > static struct ctl_table vm_table[] = { > ... > { > .procname = "hugepages_treat_as_movable", > .data = &hugepages_treat_as_movable, > .maxlen = sizeof(int), > .mode = 0644, > .proc_handler = proc_dointvec, > }, > > This seems harmless, but it's better to use int type here. > > Signed-off-by: Andrey Ryabinin <a.ryabinin@samsung.com> Acked-by: David Rientjes <rientjes@google.com> -- To unsubscribe, send a message with 'unsubscribe linux-mm' in the body to majordomo@kvack.org. For more info on Linux MM, see: http://www.linux-mm.org/ . Don't email: <a href=mailto:"dont@kvack.org"> email@kvack.org </a> ^ permalink raw reply [flat|nested] 4+ messages in thread
* Re: [PATCH 1/2] hugetlb, sysctl: pass '.extra1 = NULL' rather then '.extra1 = &zero' 2014-12-17 14:30 ` [PATCH 1/2] hugetlb, sysctl: pass '.extra1 = NULL' rather then '.extra1 = &zero' Andrey Ryabinin 2014-12-17 14:30 ` [PATCH 2/2] mm: hugetlb: fix type of hugetlb_treat_as_movable variable Andrey Ryabinin @ 2014-12-18 0:38 ` David Rientjes 1 sibling, 0 replies; 4+ messages in thread From: David Rientjes @ 2014-12-18 0:38 UTC (permalink / raw) To: Andrey Ryabinin Cc: akpm, Dmitry Vyukov, Manfred Spraul, Naoya Horiguchi, Luiz Capitulino, Kirill A. Shutemov, nadia.derbey@bull.net, aquini, Joe Perches, avagin, LKML, Kostya Serebryany, Dmitry Chernenkov, Andrey Konovalov, Konstantin Khlebnikov, kasan-dev, Davidlohr Bueso, linux-mm On Wed, 17 Dec 2014, Andrey Ryabinin wrote: > Commit ed4d4902ebdd ("mm, hugetlb: remove hugetlb_zero and hugetlb_infinity") replaced > 'unsigned long hugetlb_zero' with 'int zero' leading to out-of-bounds access > in proc_doulongvec_minmax(). > Use '.extra1 = NULL' instead of '.extra1 = &zero'. Passing NULL is equivalent to > passing minimal value, which is 0 for unsigned types. > > Reported-by: Dmitry Vyukov <dvyukov@google.com> > Suggested-by: Manfred Spraul <manfred@colorfullife.com> > Fixes: ed4d4902ebdd ("mm, hugetlb: remove hugetlb_zero and hugetlb_infinity") > Signed-off-by: Andrey Ryabinin <a.ryabinin@samsung.com> Acked-by: David Rientjes <rientjes@google.com> Patch title is a little awkward, though, maybe "mm, hugetlb: remove unnecessary lower bound on sysctl handlers"? -- To unsubscribe, send a message with 'unsubscribe linux-mm' in the body to majordomo@kvack.org. For more info on Linux MM, see: http://www.linux-mm.org/ . Don't email: <a href=mailto:"dont@kvack.org"> email@kvack.org </a> ^ permalink raw reply [flat|nested] 4+ messages in thread
end of thread, other threads:[~2014-12-18 0:40 UTC | newest]
Thread overview: 4+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
[not found] <548CA6B6.3060901@colorfullife.com>
2014-12-17 14:30 ` [PATCH 1/2] hugetlb, sysctl: pass '.extra1 = NULL' rather then '.extra1 = &zero' Andrey Ryabinin
2014-12-17 14:30 ` [PATCH 2/2] mm: hugetlb: fix type of hugetlb_treat_as_movable variable Andrey Ryabinin
2014-12-18 0:39 ` David Rientjes
2014-12-18 0:38 ` [PATCH 1/2] hugetlb, sysctl: pass '.extra1 = NULL' rather then '.extra1 = &zero' David Rientjes
This is a public inbox, see mirroring instructions for how to clone and mirror all data and code used for this inbox