• Stephen Rothwell's avatar
    [PATCH] Fix sys_move_pages when a NULL node list is passed · 8ce08464
    Stephen Rothwell authored
    sys_move_pages() uses vmalloc() to allocate an array of structures that is
    fills with information passed from user mode and then passes to
    do_stat_pages() (in the case the node list is NULL).  do_stat_pages()
    depends on a marker in the node field of the structure to decide how large
    the array is and this marker is correctly inserted into the last element of
    the array.  However, vmalloc() doesn't zero the memory it allocates and if
    the user passes NULL for the node list, then the node fields are not filled
    in (except for the end marker).  If the memory the vmalloc() returned
    happend to have a word with the marker value in it in just the right place,
    do_pages_stat will fail to fill the status field of part of the array and
    we will return (random) kernel data to user mode.
    Signed-off-by: default avatarStephen Rothwell <sfr@canb.auug.org.au>
    Cc: Christoph Lameter <clameter@engr.sgi.com>
    Cc: <stable@kernel.org>
    Signed-off-by: default avatarAndrew Morton <akpm@osdl.org>
    Signed-off-by: default avatarLinus Torvalds <torvalds@osdl.org>
    8ce08464
migrate.c 21.3 KB