linux-kernel - Re: [BUGFIX] NULL pointer dereference in __vm_enough

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20070813095302.GA7239@cvg>
Date:	Mon, 13 Aug 2007 13:53:02 +0400
From:	Cyrill Gorcunov <gorcunov@...il.com>
To:	Alan Cox <alan@...rguk.ukuu.org.uk>,
	Balbir Singh <balbir@...ux.vnet.ibm.com>,
	Andrew Morton <akpm@...ux-foundation.org>,
	linux-kernel <linux-kernel@...r.kernel.org>,
	Paul Moore <paul.moore@...com>,
	Stephen Smalley <sds@...ch.ncsc.mil>,
	Chris Vance <cvance@....com>, Wayne Salamon <wsalamon@....com>,
	James Morris <jmorris@...hat.com>, dgoeddel@...stedcs.com,
	Fengguang Wu <fengguang.wu@...il.com>
Subject: Re: [BUGFIX] NULL pointer dereference in __vm_enough_memory()

[WU Fengguang - Mon, Aug 13, 2007 at 08:23:42AM +0800]
| On Sun, Aug 12, 2007 at 08:21:43PM +0400, Cyrill Gorcunov wrote:
| > [Alan Cox - Sun, Aug 12, 2007 at 04:17:44PM +0100]
| > | Try this (it compiles but isnt tested). Its a weekend here, the sun is
| > | shining, the beach is a short walk, and I have more interesting things to
| > | do right now 8)
| > | 
| > | 
| [...]
| > | -int __vm_enough_memory(long pages, int cap_sys_admin)
| > | +int __vm_enough_memory(struct mm_struct *mm, long pages, int cap_sys_admin)
| > |  {
| > |  	unsigned long free, allowed;
| > |  
| > | @@ -166,7 +166,7 @@
| > |  
| > |  	/* Don't let a single process grow too big:
| > |  	   leave 3% of the size of this process for other processes */
| > | -	allowed -= current->mm->total_vm / 32;
| > | +	allowed -= mm->total_vm / 32;
| > 
| > So mm->total_vm is 0 for __bprm_mm_init case. Is that ok? Or I miss
| > something?
| 
| Yeah, Alan adds mm to the interfaces and leaves us the question of
| "what mm to pass in when current->mm == NULL?" ;)
| 

Well, as I see, it seems the Alan's patch is correct. We pass
newly created mm to security_vm_enough_memory_mm() and get no errors
here even for overcommit = 2. But my question was that mm->total_vm
= 0 for this case and that is probably valid too I think. What about
the thing you pointed about? Well I think security_vm_enough_memory
should never be called from kernel thread (we have secrurity_vm_enough_memory_mm
for this). But I will check it more closely. Dont get me wrong - I'm not
VMM expert and may do errors ;)

		Cyrill

-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/