linux-kernel - [PATCH] page_cgroup: fix horrid swap accounting regression

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <alpine.LSU.2.00.1203052046410.24068@eggly.anvils>
Date:	Mon, 5 Mar 2012 20:52:55 -0800 (PST)
From:	Hugh Dickins <hughd@...gle.com>
To:	Linus Torvalds <torvalds@...ux-foundation.org>
cc:	Bob Liu <lliubbo@...il.com>, Michal Hocko <mhocko@...e.cz>,
	KAMEZAWA Hiroyuki <kamezawa.hiroyu@...fujitsu.com>,
	Johannes Weiner <jweiner@...hat.com>,
	Andrew Morton <akpm@...ux-foundation.org>,
	linux-kernel@...r.kernel.org, linux-mm@...ck.org
Subject: [PATCH] page_cgroup: fix horrid swap accounting regression

Why is memcg's swap accounting so broken?  Insane counts, wrong ownership,
unfreeable structures, which later get freed and then accessed after free.

Turns out to be a tiny a little 3.3-rc1 regression in 9fb4b7cc0724
"page_cgroup: add helper function to get swap_cgroup": the helper
function (actually named lookup_swap_cgroup()) returns an address
using void* arithmetic, but the structure in question is a short.

Signed-off-by: Hugh Dickins <hughd@...gle.com>
---

 mm/page_cgroup.c |    4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

--- 3.3-rc6/mm/page_cgroup.c	2012-01-20 08:42:35.320020840 -0800
+++ linux/mm/page_cgroup.c	2012-03-05 19:51:13.535372098 -0800
@@ -379,13 +379,15 @@ static struct swap_cgroup *lookup_swap_c
 	pgoff_t offset = swp_offset(ent);
 	struct swap_cgroup_ctrl *ctrl;
 	struct page *mappage;
+	struct swap_cgroup *sc;
 
 	ctrl = &swap_cgroup_ctrl[swp_type(ent)];
 	if (ctrlp)
 		*ctrlp = ctrl;
 
 	mappage = ctrl->map[offset / SC_PER_PAGE];
-	return page_address(mappage) + offset % SC_PER_PAGE;
+	sc = page_address(mappage);
+	return sc + offset % SC_PER_PAGE;
 }
 
 /**
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/