Commit a1f846e8 authored by Jens Axboe's avatar Jens Axboe Committed by Linus Torvalds

[PATCH] sys_swapon bad arg causing slab corruption

There's an error in sys_swapon() that can cause slab corruption if you
pass in a bad specialfile pointer. getname() then returns
ERR_PTR(-EFAULT), but sys_swapon() doesn't clear name before calling
putname() on it (thus freeing 0xfffffff2, corrupting slab). An ltp test
case repeatedly crashed in later tests due to thus, irk.
parent 17563a77
...@@ -1269,8 +1269,10 @@ asmlinkage long sys_swapon(const char __user * specialfile, int swap_flags) ...@@ -1269,8 +1269,10 @@ asmlinkage long sys_swapon(const char __user * specialfile, int swap_flags)
swap_list_unlock(); swap_list_unlock();
name = getname(specialfile); name = getname(specialfile);
error = PTR_ERR(name); error = PTR_ERR(name);
if (IS_ERR(name)) if (IS_ERR(name)) {
name = NULL;
goto bad_swap_2; goto bad_swap_2;
}
swap_file = filp_open(name, O_RDWR, 0); swap_file = filp_open(name, O_RDWR, 0);
error = PTR_ERR(swap_file); error = PTR_ERR(swap_file);
if (IS_ERR(swap_file)) { if (IS_ERR(swap_file)) {
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment