linux-kernel - Re: + tmpfs-fix-oops-on-remounts-with-mpol=default.patch added to -mm tree

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-Id: <20100316143406.4C45.A69D9226@jp.fujitsu.com>
Date:	Tue, 16 Mar 2010 14:47:30 +0900 (JST)
From:	KOSAKI Motohiro <kosaki.motohiro@...fujitsu.com>
To:	kiran@...lex86.org
Cc:	kosaki.motohiro@...fujitsu.com, cl@...ux-foundation.org,
	hugh.dickins@...cali.co.uk, lee.schermerhorn@...com, mel@....ul.ie,
	stable@...nel.org, LKML <linux-kernel@...r.kernel.org>,
	linux-mm <linux-mm@...ck.org>, akpm@...ux-foundation.org
Subject: Re: + tmpfs-fix-oops-on-remounts-with-mpol=default.patch added to -mm tree

> ------------------------------------------------------
> Subject: tmpfs: fix oops on remounts with mpol=default
> From: Ravikiran G Thirumalai <kiran@...lex86.org>
> 
> Fix an 'oops' when a tmpfs mount point is remounted with the 'default'
> mempolicy.
> 
> Upon remounting a tmpfs mount point with 'mpol=default' option, the
> remount code crashed with a null pointer dereference.  The initial problem
> report was on 2.6.27, but the problem exists in mainline 2.6.34-rc as
> well.  On examining the code, we see that mpol_new returns NULL if default
> mempolicy was requested.  This 'NULL' mempolicy is accessed to store the
> node mask resulting in oops.
> 
> The following patch fixes the oops by avoiding dereferencing NULL if the
> new mempolicy is NULL.  The patch also sets 'err' to 0 if MPOL_DEFAULT is
> passed (err is initialized to 1 initially at mpol_parse_str())

Hi Ravikiran,

I'm glad to your contribution. Unfortunately I've found various related
issue in mpol_parse_str() while reviewing your patch.

So, I'll post updated patches.

- kosaki


> 
> Signed-off-by: Ravikiran Thirumalai <kiran@...lex86.org>
> Cc: KOSAKI Motohiro <kosaki.motohiro@...fujitsu.com>
> Cc: Christoph Lameter <cl@...ux-foundation.org>
> Cc: Mel Gorman <mel@....ul.ie>
> Cc: Lee Schermerhorn <lee.schermerhorn@...com>
> Cc: Hugh Dickins <hugh.dickins@...cali.co.uk>
> Cc: <stable@...nel.org>
> Signed-off-by: Andrew Morton <akpm@...ux-foundation.org>
> ---
> 
>  mm/mempolicy.c |   10 +++++++---
>  1 file changed, 7 insertions(+), 3 deletions(-)
> 
> diff -puN mm/mempolicy.c~tmpfs-fix-oops-on-remounts-with-mpol=default mm/mempolicy.c
> --- a/mm/mempolicy.c~tmpfs-fix-oops-on-remounts-with-mpol=default
> +++ a/mm/mempolicy.c
> @@ -2213,10 +2213,14 @@ int mpol_parse_str(char *str, struct mem
>  			goto out;
>  		mode = MPOL_PREFERRED;
>  		break;
> -
> +	case MPOL_DEFAULT:
> +		/*
> +		 * mpol_new() enforces empty nodemask, ignores flags.
> +		 */
> +		err = 0;
> +		break;
>  	/*
>  	 * case MPOL_BIND:    mpol_new() enforces non-empty nodemask.
> -	 * case MPOL_DEFAULT: mpol_new() enforces empty nodemask, ignores flags.
>  	 */
>  	}
>  
> @@ -2250,7 +2254,7 @@ int mpol_parse_str(char *str, struct mem
>  		if (ret) {
>  			err = 1;
>  			mpol_put(new);
> -		} else if (no_context) {
> +		} else if (no_context && new) {
>  			/* save for contextualization */
>  			new->w.user_nodemask = nodes;
>  		}
> _
> 
> Patches currently in -mm which might be from kiran@...lex86.org are
> 
> tmpfs-fix-oops-on-remounts-with-mpol=default.patch
> slab-leaks3-default-y.patch
> 



--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/