lkml.org 
[lkml]   [2009]   [Apr]   [2]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
Date
From
SubjectRe: [PATCH] - Fix slab corruption caused by alloc_cpumask_var_node()
On Thu, 2 Apr 2009 16:27:51 -0500
Jack Steiner <steiner@sgi.com> wrote:

> Fix for slab corruption caused by alloc_cpumask_var_node() overwriting
> the tail end of an off-stack cpumask.

changelog is crappy.

> --- linux.orig/lib/cpumask.c 2009-04-02 15:30:05.000000000 -0500
> +++ linux/lib/cpumask.c 2009-04-02 15:57:44.000000000 -0500
> @@ -109,10 +109,10 @@ bool alloc_cpumask_var_node(cpumask_var_
> #endif
> /* FIXME: Bandaid to save us from old primitives which go to NR_CPUS. */
> if (*mask) {
> + unsigned char *ptr = (unsigned char *)cpumask_bits(*mask);
> unsigned int tail;
> tail = BITS_TO_LONGS(NR_CPUS - nr_cpumask_bits) * sizeof(long);
> - memset(cpumask_bits(*mask) + cpumask_size() - tail,
> - 0, tail);
> + memset(ptr + cpumask_size() - tail, 0, tail);
> }
>

It appears that the bug is that cpumask_bits() returns an `unsigned
long *', except the pointer arithmetic in there is designed to operate
on char*/void*/etc, correct?

This fix is needed in 2.6.29 as well, correct?


\
 
 \ /
  Last update: 2009-04-02 23:45    [W:0.048 / U:2.264 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site