lkml.org 
[lkml]   [2012]   [Apr]   [23]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
Date
SubjectNULL-ptr deref in mmput via sys_migrate_pages in 3.4-rc4 (proly missing mm==NULL check)
From
mm/mempolicy.c
1362 mm = get_task_mm(task);
1363 put_task_struct(task);
1364 if (mm)
1365 err = do_migrate_pages(mm, old, new,
1366 capable(CAP_SYS_NICE) ? MPOL_MF_MOVE_ALL
: MPOL_MF_MOVE);
1367 else
1368 err = -EINVAL;
1369
1370 mmput(mm);

Where mmput doesn't check for mm

kernel/fork.c
567 void mmput(struct mm_struct *mm)
568 {
569 might_sleep();
570
571 if (atomic_dec_and_test(&mm->mm_users)) {


causes NULL-ptr deref

(gdb) target remote /dev/ttyS0
Remote debugging using /dev/ttyS0
mmput (mm=0x0) at kernel/fork.c:571
571 if (atomic_dec_and_test(&mm->mm_users)) {

(gdb) bt
#0 mmput (mm=0x0) at kernel/fork.c:571
#1 0xffffffff8116a1e0 in sys_migrate_pages (pid=<optimized out>,
maxnode=<optimized out>, old_nodes=<optimized out>,
new_nodes=<optimized out>) at mm/mempolicy.c:1370
#2 0xffffffff820726c9 in ?? () at arch/x86/ia32/ia32entry.S:425


(gdb) up
#1 0xffffffff8116a1e0 in sys_migrate_pages (pid=<optimized out>,
maxnode=<optimized out>, old_nodes=<optimized out>,
new_nodes=<optimized out>) at mm/mempolicy.c:1370
1370 mmput(mm);
(gdb) p mm
$1 = (struct mm_struct *) 0x0
(gdb) p task->mm
$2 = (struct mm_struct *) 0x0


--
Robert Święcki
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/

\
 
 \ /
  Last update: 2012-04-24 00:47    [W:0.049 / U:0.196 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site