lkml.org 
[lkml]   [2009]   [Apr]   [2]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
Patch in this message
/
Date
From
Subject[PATCH] - Fix slab corruption caused by alloc_cpumask_var_node()
Fix for slab corruption caused by alloc_cpumask_var_node() overwriting
the tail end of an off-stack cpumask.

Signed-off-by: Jack Steiner <steiner@sgi.com>
Acked-by: Mike Travis <travis.sgi.com>


---

Corrruption was found in latest linux-next (4/1)
v2.6.29-12081-g421a9f3



lib/cpumask.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)

Index: linux/lib/cpumask.c
===================================================================
--- linux.orig/lib/cpumask.c 2009-04-02 15:30:05.000000000 -0500
+++ linux/lib/cpumask.c 2009-04-02 15:57:44.000000000 -0500
@@ -109,10 +109,10 @@ bool alloc_cpumask_var_node(cpumask_var_
#endif
/* FIXME: Bandaid to save us from old primitives which go to NR_CPUS. */
if (*mask) {
+ unsigned char *ptr = (unsigned char *)cpumask_bits(*mask);
unsigned int tail;
tail = BITS_TO_LONGS(NR_CPUS - nr_cpumask_bits) * sizeof(long);
- memset(cpumask_bits(*mask) + cpumask_size() - tail,
- 0, tail);
+ memset(ptr + cpumask_size() - tail, 0, tail);
}

return *mask != NULL;

\
 
 \ /
  Last update: 2009-04-02 23:39    [W:0.040 / U:0.396 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site