linux-kernel - patch fix-sys_move_pages-when-a-null-node-list-is-passed.patch queued to -stable tree

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-Id: <200611052223.kA5MNfBn028173@sous-sol.org>
Date:	Sun, 05 Nov 2006 14:23:41 -0800
From:	chrisw@...s-sol.org
To:	sfr@...b.auug.org.au, akpm@...l.org, chrisw@...s-sol.org,
	clameter@....com, linux-kernel@...r.kernel.org
Cc:	<stable@...nel.org>
Subject: patch fix-sys_move_pages-when-a-null-node-list-is-passed.patch queued to -stable tree


This is a note to let you know that we have just queued up the patch titled

     Subject: Fix sys_move_pages when a NULL node list is passed.

to the 2.6.18-stable tree.  Its filename is

     fix-sys_move_pages-when-a-null-node-list-is-passed.patch

A git repo of this tree can be found at 
    http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary


>From stable-bounces@...ux.kernel.org  Thu Nov  2 19:46:17 2006
Date: Fri, 3 Nov 2006 14:42:43 +1100
From: Stephen Rothwell <sfr@...b.auug.org.au>
To: Christoph Lameter <clameter@....com>
Message-Id: <20061103144243.4601ba76.sfr@...b.auug.org.au>
Cc: Andrew Morton <akpm@...l.org>, linux-mm@...ck.org, LKML <linux-kernel@...r.kernel.org>, stable@...nel.org
Subject: Fix sys_move_pages when a NULL node list is passed.

sys_move_pages() uses vmalloc() to allocate an array of structures
that is fills with information passed from user mode and then passes to
do_stat_pages() (in the case the node list is NULL).  do_stat_pages()
depends on a marker in the node field of the structure to decide how large
the array is and this marker is correctly inserted into the last element
of the array.  However, vmalloc() doesn't zero the memory it allocates
and if the user passes NULL for the node list, then the node fields are
not filled in (except for the end marker).  If the memory the vmalloc()
returned happend to have a word with the marker value in it in just the
right place, do_pages_stat will fail to fill the status field of part
of the array and we will return (random) kernel data to user mode.

Signed-off-by: Stephen Rothwell <sfr@...b.auug.org.au>
Acked-by: Christoph Lameter <clameter@....com>
Signed-off-by: Chris Wright <chrisw@...s-sol.org>
---
 mm/migrate.c |    3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

--- linux-2.6.18.2.orig/mm/migrate.c
+++ linux-2.6.18.2/mm/migrate.c
@@ -950,7 +950,8 @@ asmlinkage long sys_move_pages(pid_t pid
 				goto out;
 
 			pm[i].node = node;
-		}
+		} else
+			pm[i].node = 0;	/* anything to not match MAX_NUMNODES */
 	}
 	/* End marker */
 	pm[nr_pages].node = MAX_NUMNODES;


Patches currently in stable-queue which might be from sfr@...b.auug.org.au are

queue-2.6.18/fix-sys_move_pages-when-a-null-node-list-is-passed.patch
-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/