aboutsummaryrefslogtreecommitdiffstats
path: root/mm
diff options
context:
space:
mode:
authorStephen Rothwell <sfr@canb.auug.org.au>2006-11-03 01:07:28 -0500
committerLinus Torvalds <torvalds@g5.osdl.org>2006-11-03 15:27:59 -0500
commit8ce08464d2c749610a52c4d6c7c11080a7eaaef1 (patch)
tree43e49b80ee51a2ca0c95ade6df2831e95c7073c6 /mm
parentcda5e61a8e0b11826780b8e5a4155683f0557c8b (diff)
[PATCH] Fix sys_move_pages when a NULL node list is passed
sys_move_pages() uses vmalloc() to allocate an array of structures that is fills with information passed from user mode and then passes to do_stat_pages() (in the case the node list is NULL). do_stat_pages() depends on a marker in the node field of the structure to decide how large the array is and this marker is correctly inserted into the last element of the array. However, vmalloc() doesn't zero the memory it allocates and if the user passes NULL for the node list, then the node fields are not filled in (except for the end marker). If the memory the vmalloc() returned happend to have a word with the marker value in it in just the right place, do_pages_stat will fail to fill the status field of part of the array and we will return (random) kernel data to user mode. Signed-off-by: Stephen Rothwell <sfr@canb.auug.org.au> Cc: Christoph Lameter <clameter@engr.sgi.com> Cc: <stable@kernel.org> Signed-off-by: Andrew Morton <akpm@osdl.org> Signed-off-by: Linus Torvalds <torvalds@osdl.org>
Diffstat (limited to 'mm')
-rw-r--r--mm/migrate.c3
1 files changed, 2 insertions, 1 deletions
diff --git a/mm/migrate.c b/mm/migrate.c
index ba2453f9483d..b4979d423d2b 100644
--- a/mm/migrate.c
+++ b/mm/migrate.c
@@ -952,7 +952,8 @@ asmlinkage long sys_move_pages(pid_t pid, unsigned long nr_pages,
952 goto out; 952 goto out;
953 953
954 pm[i].node = node; 954 pm[i].node = node;
955 } 955 } else
956 pm[i].node = 0; /* anything to not match MAX_NUMNODES */
956 } 957 }
957 /* End marker */ 958 /* End marker */
958 pm[nr_pages].node = MAX_NUMNODES; 959 pm[nr_pages].node = MAX_NUMNODES;