* [PATCH] mm/mempolicy: fix get_nodes out of bound access
@ 2022-06-01 9:32 Tianyu Li
0 siblings, 0 replies; only message in thread
From: Tianyu Li @ 2022-06-01 9:32 UTC (permalink / raw)
To: Andrew Morton, Arnd Bergmann, open list:MEMORY MANAGEMENT, open list
Cc: nd, Tianyu Li
When user specified more nodes than supported,
get_nodes will access nmask array out of bound.
Fixes: e130242dc351 ("mm: simplify compat numa syscalls")
Signed-off-by: Tianyu Li <tianyu.li@arm.com>
---
mm/mempolicy.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/mm/mempolicy.c b/mm/mempolicy.c
index 0b4ba3ee810e..9f27dc4b66ba 100644
--- a/mm/mempolicy.c
+++ b/mm/mempolicy.c
@@ -1388,7 +1388,7 @@ static int get_nodes(nodemask_t *nodes, const unsigned long __user *nmask,
unsigned long bits = min_t(unsigned long, maxnode, BITS_PER_LONG);
unsigned long t;
- if (get_bitmap(&t, &nmask[maxnode / BITS_PER_LONG], bits))
+ if (get_bitmap(&t, &nmask[(maxnode - 1) / BITS_PER_LONG], bits))
return -EFAULT;
if (maxnode - bits >= MAX_NUMNODES) {
--
2.25.1
^ permalink raw reply [flat|nested] only message in thread
only message in thread, other threads:[~2022-06-01 9:33 UTC | newest]
Thread overview: (only message) (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2022-06-01 9:32 [PATCH] mm/mempolicy: fix get_nodes out of bound access Tianyu Li
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox