lkml.org 
[lkml]   [2009]   [Apr]   [30]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    Date
    From
    Subject[patch 24/88] mm: do_xip_mapping_read: fix length calculation
    2.6.28-stable review patch.  If anyone has any objections, please let us know.

    ------------------

    From: Martin Schwidefsky <schwidefsky@de.ibm.com>

    upstream commit: 58984ce21d315b70df1a43644df7416ea7c9bfd8

    The calculation of the value nr in do_xip_mapping_read is incorrect. If
    the copy required more than one iteration in the do while loop the copies
    variable will be non-zero. The maximum length that may be passed to the
    call to copy_to_user(buf+copied, xip_mem+offset, nr) is len-copied but the
    check only compares against (nr > len).

    This bug is the cause for the heap corruption Carsten has been chasing
    for so long:

    *** glibc detected *** /bin/bash: free(): invalid next size (normal): 0x00000000800e39f0 ***
    ======= Backtrace: =========
    /lib64/libc.so.6[0x200000b9b44]
    /lib64/libc.so.6(cfree+0x8e)[0x200000bdade]
    /bin/bash(free_buffered_stream+0x32)[0x80050e4e]
    /bin/bash(close_buffered_stream+0x1c)[0x80050ea4]
    /bin/bash(unset_bash_input+0x2a)[0x8001c366]
    /bin/bash(make_child+0x1d4)[0x8004115c]
    /bin/bash[0x8002fc3c]
    /bin/bash(execute_command_internal+0x656)[0x8003048e]
    /bin/bash(execute_command+0x5e)[0x80031e1e]
    /bin/bash(execute_command_internal+0x79a)[0x800305d2]
    /bin/bash(execute_command+0x5e)[0x80031e1e]
    /bin/bash(reader_loop+0x270)[0x8001efe0]
    /bin/bash(main+0x1328)[0x8001e960]
    /lib64/libc.so.6(__libc_start_main+0x100)[0x200000592a8]
    /bin/bash(clearerr+0x5e)[0x8001c092]

    With this bug fix the commit 0e4a9b59282914fe057ab17027f55123964bc2e2
    "ext2/xip: refuse to change xip flag during remount with busy inodes" can
    be removed again.

    Cc: Carsten Otte <cotte@de.ibm.com>
    Cc: Nick Piggin <npiggin@suse.de>
    Cc: Jared Hulbert <jaredeh@gmail.com>
    Signed-off-by: Martin Schwidefsky <schwidefsky@de.ibm.com>
    Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
    Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
    Signed-off-by: Chris Wright <chrisw@sous-sol.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

    ---
    mm/filemap_xip.c | 4 ++--
    1 file changed, 2 insertions(+), 2 deletions(-)

    --- a/mm/filemap_xip.c
    +++ b/mm/filemap_xip.c
    @@ -89,8 +89,8 @@ do_xip_mapping_read(struct address_space
    }
    }
    nr = nr - offset;
    - if (nr > len)
    - nr = len;
    + if (nr > len - copied)
    + nr = len - copied;

    error = mapping->a_ops->get_xip_mem(mapping, index, 0,
    &xip_mem, &xip_pfn);



    \
     
     \ /
      Last update: 2009-04-30 19:21    [W:4.343 / U:0.576 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site