[lkml]   [2009]   [Apr]   [30]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
Messages in this thread
    Patch in this message
    Subject[patch 24/88] mm: do_xip_mapping_read: fix length calculation
    2.6.28-stable review patch.  If anyone has any objections, please let us know.


    From: Martin Schwidefsky <>

    upstream commit: 58984ce21d315b70df1a43644df7416ea7c9bfd8

    The calculation of the value nr in do_xip_mapping_read is incorrect. If
    the copy required more than one iteration in the do while loop the copies
    variable will be non-zero. The maximum length that may be passed to the
    call to copy_to_user(buf+copied, xip_mem+offset, nr) is len-copied but the
    check only compares against (nr > len).

    This bug is the cause for the heap corruption Carsten has been chasing
    for so long:

    *** glibc detected *** /bin/bash: free(): invalid next size (normal): 0x00000000800e39f0 ***
    ======= Backtrace: =========

    With this bug fix the commit 0e4a9b59282914fe057ab17027f55123964bc2e2
    "ext2/xip: refuse to change xip flag during remount with busy inodes" can
    be removed again.

    Cc: Carsten Otte <>
    Cc: Nick Piggin <>
    Cc: Jared Hulbert <>
    Signed-off-by: Martin Schwidefsky <>
    Signed-off-by: Andrew Morton <>
    Signed-off-by: Linus Torvalds <>
    Signed-off-by: Chris Wright <>
    Signed-off-by: Greg Kroah-Hartman <>

    mm/filemap_xip.c | 4 ++--
    1 file changed, 2 insertions(+), 2 deletions(-)

    --- a/mm/filemap_xip.c
    +++ b/mm/filemap_xip.c
    @@ -89,8 +89,8 @@ do_xip_mapping_read(struct address_space
    nr = nr - offset;
    - if (nr > len)
    - nr = len;
    + if (nr > len - copied)
    + nr = len - copied;

    error = mapping->a_ops->get_xip_mem(mapping, index, 0,
    &xip_mem, &xip_pfn);

     \ /
      Last update: 2009-04-30 19:21    [W:0.020 / U:42.056 seconds]
    ©2003-2016 Jasper Spaans. hosted at Digital OceanAdvertise on this site