lkml.org 
[lkml]   [2010]   [Oct]   [22]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    Date
    From
    Subject[014/103] lib/list_sort: do not pass bad pointers to cmp callback
    2.6.35-stable review patch.  If anyone has any objections, please let us know.

    ------------------

    From: Don Mullis <don.mullis@gmail.com>

    commit f015ac3edd84ad72f88e08a4d83c56c360aae404 upstream.

    If the original list is a POT in length, the first callback from line 73
    will pass a==b both pointing to the original list_head. This is dangerous
    because the 'list_sort()' user can use 'container_of()' and accesses the
    "containing" object, which does not necessary exist for the list head. So
    the user can access RAM which does not belong to him. If this is a write
    access, we can end up with memory corruption.

    Signed-off-by: Don Mullis <don.mullis@gmail.com>
    Tested-by: Artem Bityutskiy <Artem.Bityutskiy@nokia.com>
    Signed-off-by: Artem Bityutskiy <Artem.Bityutskiy@nokia.com>
    Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
    Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

    ---
    lib/list_sort.c | 2 +-
    1 file changed, 1 insertion(+), 1 deletion(-)

    --- a/lib/list_sort.c
    +++ b/lib/list_sort.c
    @@ -70,7 +70,7 @@ static void merge_and_restore_back_links
    * element comparison is needed, so the client's cmp()
    * routine can invoke cond_resched() periodically.
    */
    - (*cmp)(priv, tail, tail);
    + (*cmp)(priv, tail->next, tail->next);

    tail->next->prev = tail;
    tail = tail->next;



    \
     
     \ /
      Last update: 2010-10-22 20:59    [W:4.514 / U:0.008 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site