linux-kernel - Re: [BUGFIX] NULL pointer dereference in __vm_enough

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20070812052915.GA6769@mail.ustc.edu.cn>
Date:	Sun, 12 Aug 2007 13:29:15 +0800
From:	Fengguang Wu <fengguang.wu@...il.com>
To:	Cyrill Gorcunov <gorcunov@...il.com>
Cc:	Andrew Morton <akpm@...ux-foundation.org>,
	linux-kernel <linux-kernel@...r.kernel.org>
Subject: Re: [BUGFIX] NULL pointer dereference in __vm_enough_memory()

On Sat, Aug 11, 2007 at 06:17:14PM +0400, Cyrill Gorcunov wrote:
> [Fengguang Wu - Sat, Aug 11, 2007 at 09:21:31PM +0800]
> | Andrew,
> | 
> | I'm not sure if this patch is the right fix for the bug.  But it do
> | stops the oops message. The bug also happens in 2.6.23-rc1-mm2/2.6.23-rc2-mm2.
> | I'm running debian/sid. The .config is attached.
> | 
> |
> 
> [...snip...]
> 
> Even if you're right you have to make the same patch for
> mm/nommu.c but I've an anticipation the problem is growing
> up from another point (and I'm really hoping that I'm wrong ;)

Thank you, the patch is updated to:
===

Fix possible NULL pointer deference on __vm_enough_memory().

Cc: Cyrill Gorcunov <gorcunov@...il.com>
Signed-off-by: Fengguang Wu <wfg@...l.ustc.edu.cn>
---
 mm/mmap.c  |    3 ++-
 mm/nommu.c |    3 ++-
 2 files changed, 4 insertions(+), 2 deletions(-)

--- linux-2.6.23-rc2-mm2.orig/mm/mmap.c
+++ linux-2.6.23-rc2-mm2/mm/mmap.c
@@ -166,7 +166,8 @@ int __vm_enough_memory(long pages, int c
 
 	/* Don't let a single process grow too big:
 	   leave 3% of the size of this process for other processes */
-	allowed -= current->mm->total_vm / 32;
+	if (current->mm)
+		allowed -= current->mm->total_vm / 32;
 
 	/*
 	 * cast `allowed' as a signed long because vm_committed_space
--- linux-2.6.23-rc2-mm2.orig/mm/nommu.c
+++ linux-2.6.23-rc2-mm2/mm/nommu.c
@@ -1342,7 +1342,8 @@ int __vm_enough_memory(long pages, int c
 
 	/* Don't let a single process grow too big:
 	   leave 3% of the size of this process for other processes */
-	allowed -= current->mm->total_vm / 32;
+	if (current->mm)
+		allowed -= current->mm->total_vm / 32;
 
 	/*
 	 * cast `allowed' as a signed long because vm_committed_space

-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/