linux-kernel - Re: [PATCH] sgi-xp: add type cast to kzalloc()'d space to avoid slab corruption

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-Id: <20090203120147.dd079ffd.akpm@linux-foundation.org>
Date:	Tue, 3 Feb 2009 12:01:47 -0800
From:	Andrew Morton <akpm@...ux-foundation.org>
To:	Dean Nelson <dcn@....com>
Cc:	linux-kernel@...r.kernel.org
Subject: Re: [PATCH] sgi-xp: add type cast to kzalloc()'d space to avoid
 slab corruption

On Tue, 3 Feb 2009 12:23:38 -0600
Dean Nelson <dcn@....com> wrote:

> A missing type cast results in writing way beyond the end of a kzalloc()'d
> memory segment resulting in slab corruption.
> 
> Signed-off-by: Dean Nelson <dcn@....com>
> Cc: stable <stable@...nel.org>
> 
> ---
> 
>  drivers/misc/sgi-xp/xpc_uv.c |    8 ++++----
>  1 file changed, 4 insertions(+), 4 deletions(-)
> 
> Index: linux/drivers/misc/sgi-xp/xpc_uv.c
> ===================================================================
> --- linux.orig/drivers/misc/sgi-xp/xpc_uv.c	2009-01-27 10:53:26.000000000 -0600
> +++ linux/drivers/misc/sgi-xp/xpc_uv.c	2009-01-28 08:51:57.000000000 -0600
> @@ -3,7 +3,7 @@
>   * License.  See the file "COPYING" in the main directory of this archive
>   * for more details.
>   *
> - * Copyright (c) 2008 Silicon Graphics, Inc.  All Rights Reserved.
> + * Copyright (c) 2008-2009 Silicon Graphics, Inc.  All Rights Reserved.
>   */
>  
>  /*
> @@ -1129,8 +1129,8 @@ xpc_allocate_recv_msg_slot_uv(struct xpc
>  			continue;
>  
>  		for (entry = 0; entry < nentries; entry++) {
> -			msg_slot = ch_uv->recv_msg_slots + entry *
> -			    ch->entry_size;
> +			msg_slot = (struct xpc_notify_mq_msg_uv *)((u8 *)
> +			    ch_uv->recv_msg_slots + entry * ch->entry_size);

So..  ch->entry_size is not equal to sizeof(struct xpc_notify_mq_msg_uv)?

Perhaps ->recv_msg_slots should never have had type struct
xpc_notify_mq_msg_uv *?

>  			msg_slot->hdr.msg_slot_number = entry;
>  		}
> @@ -1438,7 +1438,7 @@ xpc_handle_notify_mq_msg_uv(struct xpc_p
>  	/* we're dealing with a normal message sent via the notify_mq */
>  	ch_uv = &ch->sn.uv;
>  
> -	msg_slot = (struct xpc_notify_mq_msg_uv *)((u64)ch_uv->recv_msg_slots +
> +	msg_slot = (struct xpc_notify_mq_msg_uv *)((u8 *)ch_uv->recv_msg_slots +
>  		    (msg->hdr.msg_slot_number % ch->remote_nentries) *
>  		    ch->entry_size);

This hunk doesn't change anything?
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/