Commit e20d103b authored by Mark Hairgrove's avatar Mark Hairgrove Committed by Linus Torvalds

mm/migrate: fix indexing bug (off by one) and avoid out of bound access

Index was incremented before last use and thus the second array could
dereference to an invalid address (not mentioning the fact that it did
not properly clear the entry we intended to clear).

Link: http://lkml.kernel.org/r/1506973525-16491-1-git-send-email-jglisse@redhat.com
Fixes: 8315ada7 ("mm/migrate: allow migrate_vma() to alloc new page on empty entry")
Signed-off-by: default avatarMark Hairgrove <mhairgrove@nvidia.com>
Signed-off-by: default avatarJérôme Glisse <jglisse@redhat.com>
Cc: Reza Arbab <arbab@linux.vnet.ibm.com>
Signed-off-by: default avatarAndrew Morton <akpm@linux-foundation.org>
Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
parent 997301a8
...@@ -2146,8 +2146,9 @@ static int migrate_vma_collect_hole(unsigned long start, ...@@ -2146,8 +2146,9 @@ static int migrate_vma_collect_hole(unsigned long start,
unsigned long addr; unsigned long addr;
for (addr = start & PAGE_MASK; addr < end; addr += PAGE_SIZE) { for (addr = start & PAGE_MASK; addr < end; addr += PAGE_SIZE) {
migrate->src[migrate->npages++] = MIGRATE_PFN_MIGRATE; migrate->src[migrate->npages] = MIGRATE_PFN_MIGRATE;
migrate->dst[migrate->npages] = 0; migrate->dst[migrate->npages] = 0;
migrate->npages++;
migrate->cpages++; migrate->cpages++;
} }
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment