linux-kernel - [PATCH] mm: vmalloc: Check for page allocation failure before vmlist insertion

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Date:	Mon, 5 Dec 2011 14:07:51 +0000
From:	Mel Gorman <mgorman@...e.de>
To:	Andrew Morton <akpm@...ux-foundation.org>
Cc:	David Rientjes <rientjes@...gle.com>,
	Namhyung Kim <namhyung@...il.com>,
	Luciano Chavez <lnx1138@...ux.vnet.ibm.com>,
	Linux-MM <linux-mm@...ck.org>,
	LKML <linux-kernel@...r.kernel.org>
Subject: [PATCH] mm: vmalloc: Check for page allocation failure before vmlist
 insertion

Commit [f5252e00: mm: avoid null pointer access in vm_struct via
/proc/vmallocinfo] adds newly allocated vm_structs to the vmlist
after it is fully initialised. Unfortunately, it did not check that
__vmalloc_area_node() successfully populated the area. In the event
of allocation failure, the vmalloc area is freed but the pointer to
freed memory is inserted into the vmlist leading to a a crash later
in get_vmalloc_info().

This patch adds a check for ____vmalloc_area_node() failure within
__vmalloc_node_range. It does not use "goto fail" as in the previous
error path as a warning was already displayed by __vmalloc_area_node()
before it called vfree in its failure path.

Credit goes to Luciano Chavez for doing all the real work of
identifying exactly where the problem was.

If accepted, this should be considered a -stable candidate.

Reported-and-tested-by: Luciano Chavez <lnx1138@...ux.vnet.ibm.com>
Signed-off-by: Mel Gorman <mgorman@...e.de>
---
 mm/vmalloc.c |    2 ++
 1 files changed, 2 insertions(+), 0 deletions(-)

diff --git a/mm/vmalloc.c b/mm/vmalloc.c
index 3231bf3..1d8b32f 100644
--- a/mm/vmalloc.c
+++ b/mm/vmalloc.c
@@ -1633,6 +1633,8 @@ void *__vmalloc_node_range(unsigned long size, unsigned long align,
 		goto fail;

 	addr = __vmalloc_area_node(area, gfp_mask, prot, node, caller);
+	if (!addr)
+		return NULL;

 	/*
 	 * In this function, newly allocated vm_struct is not added
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/