lkml.org 
[lkml]   [2008]   [Apr]   [29]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    Date
    From
    Subject[31/37] mm: fix possible off-by-one in walk_pte_range()
    2.6.25-stable review patch.  If anyone has any objections, please let us
    know.

    ------------------
    From: Johannes Weiner <hannes@saeurebad.de>
    commit 556637cdabcd5918c7d4a1a2679b8f86fc81e891 upstream


    After the loop in walk_pte_range() pte might point to the first address after
    the pmd it walks. The pte_unmap() is then applied to something bad.

    Spotted by Roel Kluin and Andreas Schwab.

    Signed-off-by: Johannes Weiner <hannes@saeurebad.de>
    Cc: Roel Kluin <12o3l@tiscali.nl>
    Cc: Andreas Schwab <schwab@suse.de>
    Acked-by: Matt Mackall <mpm@selenic.com>
    Acked-by: Mikael Pettersson <mikpe@it.uu.se>
    Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
    Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

    ---
    mm/pagewalk.c | 8 ++++++--
    1 file changed, 6 insertions(+), 2 deletions(-)
    --- a/mm/pagewalk.c
    +++ b/mm/pagewalk.c
    @@ -9,11 +9,15 @@ static int walk_pte_range(pmd_t *pmd, un
    int err = 0;

    pte = pte_offset_map(pmd, addr);
    - do {
    + for (;;) {
    err = walk->pte_entry(pte, addr, addr + PAGE_SIZE, private);
    if (err)
    break;
    - } while (pte++, addr += PAGE_SIZE, addr != end);
    + addr += PAGE_SIZE;
    + if (addr == end)
    + break;
    + pte++;
    + }

    pte_unmap(pte);
    return err;
    --


    \
     
     \ /
      Last update: 2008-04-29 19:35    [from the cache]
    ©2003-2014 Jasper Spaans. hosted at Digital Ocean