linux-kernel - Re: [PATCH] - Updated: Fix slab corruption caused by alloc_cpumask_var

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Thu, 2 Apr 2009 17:09:01 -0500
From:	Jack Steiner <steiner@....com>
To:	Andrew Morton <akpm@...ux-foundation.org>, mingo@...e.hu,
	rusty@...tcorp.com.au, sfr@...b.auug.org.au
Cc:	linux-kernel@...r.kernel.org, stable@...nel.org
Subject: Re: [PATCH] - Updated: Fix slab corruption caused by alloc_cpumask_var_node()

Fix slab corruption caused by alloc_cpumask_var_node() overwriting
the tail end of an off-stack cpumask.

The function zeros out cpumask bits beyond the last possible cpu.
The starting point for zeroing should be the beginning
of the mask offset by a byte count derived from the number
of possible cpus. The offset was calculated in bits instead of bytes.
This resulted in overwriting the end of the cpumask.


v2.6.29 is also affected by this bug.


Signed-off-by: Jack Steiner <steiner@....com>
Acked-by: Mike Travis <travis.sgi.com>
Acked-by: Ingo Molnar <mingo@...e.hu>


---

Corrruption was found in latest linux-next (4/1)
	v2.6.29-12081-g421a9f3



 lib/cpumask.c |    4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

Index: linux/lib/cpumask.c
===================================================================
--- linux.orig/lib/cpumask.c	2009-04-02 15:30:05.000000000 -0500
+++ linux/lib/cpumask.c	2009-04-02 15:57:44.000000000 -0500
@@ -109,10 +109,10 @@ bool alloc_cpumask_var_node(cpumask_var_
 #endif
 	/* FIXME: Bandaid to save us from old primitives which go to NR_CPUS. */
 	if (*mask) {
+		unsigned char *ptr = (unsigned char *)cpumask_bits(*mask);
 		unsigned int tail;
 		tail = BITS_TO_LONGS(NR_CPUS - nr_cpumask_bits) * sizeof(long);
-		memset(cpumask_bits(*mask) + cpumask_size() - tail,
-		       0, tail);
+		memset(ptr + cpumask_size() - tail, 0, tail);
 	}
 
 	return *mask != NULL;
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/