linux-kernel - [PATCH] - Fix memory corruption in slbq

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Date:	Thu, 30 Apr 2009 19:41:06 -0500
From:	Jack Steiner <steiner@....com>
To:	akpm@...ux-foundation.org, piggin@...e.de
Cc:	linux-kernel@...r.kernel.org
Subject: [PATCH] - Fix memory corruption in slbq

Fix memory corruption caused by slqb overrunning the end
of the page allocated in kmem_cache_dyn_array_alloc() for
initial caches.


Signed-off-by: Jack Steiner <steiner@....com>

---
 mm/slqb.c |    5 ++---
 1 file changed, 2 insertions(+), 3 deletions(-)

Index: linux/mm/slqb.c
===================================================================
--- linux.orig/mm/slqb.c	2009-04-30 15:47:16.000000000 -0500
+++ linux/mm/slqb.c	2009-04-30 19:08:33.000000000 -0500
@@ -2194,15 +2194,14 @@ static void *kmem_cache_dyn_array_alloc(
 		 * never get freed by definition so we can do it rather
 		 * simply.
 		 */
-		if (!nextmem) {
+		if (!nextmem || offset_in_page(nextmem) + size > PAGE_SIZE) {
 			nextmem = alloc_pages_exact(size, GFP_KERNEL);
 			if (!nextmem)
 				return NULL;
 		}
 		ret = nextmem;
 		nextmem = (void *)((unsigned long)ret + size);
-		if ((unsigned long)ret >> PAGE_SHIFT !=
-				(unsigned long)nextmem >> PAGE_SHIFT)
+		if (offset_in_page(ret) + size >= PAGE_SIZE)
 			nextmem = NULL;
 		memset(ret, 0, size);
 		return ret;
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/