Messages in this thread | | | From | Nick Piggin <> | Subject | Re: [PATCH 02/10] module: fix out-of-range memory access | Date | Thu, 19 Feb 2009 23:08:04 +1100 |
| |
On Wednesday 18 February 2009 23:04:28 Tejun Heo wrote: > Impact: subtle memory access bug fix > > percpu_modalloc() may access pcpu_size[-1]. The access won't change > the value by itself but it still is read/write access and dangerous. > Fix it.
Ditto for this one...
> > Signed-off-by: Tejun Heo <tj@kernel.org> > --- > kernel/module.c | 14 ++++++++------ > 1 files changed, 8 insertions(+), 6 deletions(-) > > diff --git a/kernel/module.c b/kernel/module.c > index ba22484..d54a63e 100644 > --- a/kernel/module.c > +++ b/kernel/module.c > @@ -426,12 +426,14 @@ static void *percpu_modalloc(unsigned long size, > unsigned long align, continue; > > /* Transfer extra to previous block. */ > - if (pcpu_size[i-1] < 0) > - pcpu_size[i-1] -= extra; > - else > - pcpu_size[i-1] += extra; > - pcpu_size[i] -= extra; > - ptr += extra; > + if (extra) { > + if (pcpu_size[i-1] < 0) > + pcpu_size[i-1] -= extra; > + else > + pcpu_size[i-1] += extra; > + pcpu_size[i] -= extra; > + ptr += extra; > + } > > /* Split block if warranted */ > if (pcpu_size[i] - size > sizeof(unsigned long))
| |