linux-mm.kvack.org archive mirror
 help / color / mirror / Atom feed
* [PATCH] Fix sys_move_pages when a NULL node list is passed.
@ 2006-11-03  3:42 Stephen Rothwell
  2006-11-03  5:13 ` Christoph Lameter
  2006-11-08  1:56 ` KAMEZAWA Hiroyuki
  0 siblings, 2 replies; 7+ messages in thread
From: Stephen Rothwell @ 2006-11-03  3:42 UTC (permalink / raw)
  To: Christoph Lameter; +Cc: LKML, linux-mm, stable, Andrew Morton

sys_move_pages() uses vmalloc() to allocate an array of structures
that is fills with information passed from user mode and then passes to
do_stat_pages() (in the case the node list is NULL).  do_stat_pages()
depends on a marker in the node field of the structure to decide how large
the array is and this marker is correctly inserted into the last element
of the array.  However, vmalloc() doesn't zero the memory it allocates
and if the user passes NULL for the node list, then the node fields are
not filled in (except for the end marker).  If the memory the vmalloc()
returned happend to have a word with the marker value in it in just the
right place, do_pages_stat will fail to fill the status field of part
of the array and we will return (random) kernel data to user mode.

Signed-off-by: Stephen Rothwell <sfr@canb.auug.org.au>
---
 mm/migrate.c |    3 ++-
 1 files changed, 2 insertions(+), 1 deletions(-)

This has been tested in PowerPC (after wiring up sys_move_pages).  This
should go into 2.6.19 as it leaks kernel memory.  It should also be
submitted to the 2.6.18 stable tree (as sys_move_pages was introduced
before 2.6.18-rc2).

-- 
Cheers,
Stephen Rothwell                    sfr@canb.auug.org.au

diff --git a/mm/migrate.c b/mm/migrate.c
index ba2453f..b4979d4 100644
--- a/mm/migrate.c
+++ b/mm/migrate.c
@@ -952,7 +952,8 @@ asmlinkage long sys_move_pages(pid_t pid
 				goto out;
 
 			pm[i].node = node;
-		}
+		} else
+			pm[i].node = 0;	/* anything to not match MAX_NUMNODES */
 	}
 	/* End marker */
 	pm[nr_pages].node = MAX_NUMNODES;
-- 
1.4.3.2

--
To unsubscribe, send a message with 'unsubscribe linux-mm' in
the body to majordomo@kvack.org.  For more info on Linux MM,
see: http://www.linux-mm.org/ .
Don't email: <a href=mailto:"dont@kvack.org"> email@kvack.org </a>

^ permalink raw reply	[flat|nested] 7+ messages in thread
end of thread, other threads:[~2006-11-08  2:57 UTC | newest]

Thread overview: 7+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2006-11-03  3:42 [PATCH] Fix sys_move_pages when a NULL node list is passed Stephen Rothwell
2006-11-03  5:13 ` Christoph Lameter
2006-11-08  1:56 ` KAMEZAWA Hiroyuki
2006-11-08  2:01   ` Christoph Lameter
2006-11-08  2:13     ` KAMEZAWA Hiroyuki
2006-11-08  2:47       ` Stephen Rothwell
2006-11-08  2:57         ` KAMEZAWA Hiroyuki

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox