Messages in this thread Patch in this message | | | From | Tejun Heo <> | Subject | [PATCH 02/10] module: fix out-of-range memory access | Date | Wed, 18 Feb 2009 21:04:28 +0900 |
| |
Impact: subtle memory access bug fix
percpu_modalloc() may access pcpu_size[-1]. The access won't change the value by itself but it still is read/write access and dangerous. Fix it.
Signed-off-by: Tejun Heo <tj@kernel.org> --- kernel/module.c | 14 ++++++++------ 1 files changed, 8 insertions(+), 6 deletions(-)
diff --git a/kernel/module.c b/kernel/module.c index ba22484..d54a63e 100644 --- a/kernel/module.c +++ b/kernel/module.c @@ -426,12 +426,14 @@ static void *percpu_modalloc(unsigned long size, unsigned long align, continue; /* Transfer extra to previous block. */ - if (pcpu_size[i-1] < 0) - pcpu_size[i-1] -= extra; - else - pcpu_size[i-1] += extra; - pcpu_size[i] -= extra; - ptr += extra; + if (extra) { + if (pcpu_size[i-1] < 0) + pcpu_size[i-1] -= extra; + else + pcpu_size[i-1] += extra; + pcpu_size[i] -= extra; + ptr += extra; + } /* Split block if warranted */ if (pcpu_size[i] - size > sizeof(unsigned long)) -- 1.6.0.2
| |