Re: [PATCH] - Updated: Fix slab corruption caused by alloc_cpumask_var_node()

From: Jack Steiner
Date: Thu Apr 02 2009 - 18:09:20 EST


Fix slab corruption caused by alloc_cpumask_var_node() overwriting
the tail end of an off-stack cpumask.

The function zeros out cpumask bits beyond the last possible cpu.
The starting point for zeroing should be the beginning
of the mask offset by a byte count derived from the number
of possible cpus. The offset was calculated in bits instead of bytes.
This resulted in overwriting the end of the cpumask.


v2.6.29 is also affected by this bug.


Signed-off-by: Jack Steiner <steiner@xxxxxxx>
Acked-by: Mike Travis <travis.sgi.com>
Acked-by: Ingo Molnar <mingo@xxxxxxx>


---

Corrruption was found in latest linux-next (4/1)
v2.6.29-12081-g421a9f3



lib/cpumask.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)

Index: linux/lib/cpumask.c
===================================================================
--- linux.orig/lib/cpumask.c 2009-04-02 15:30:05.000000000 -0500
+++ linux/lib/cpumask.c 2009-04-02 15:57:44.000000000 -0500
@@ -109,10 +109,10 @@ bool alloc_cpumask_var_node(cpumask_var_
#endif
/* FIXME: Bandaid to save us from old primitives which go to NR_CPUS. */
if (*mask) {
+ unsigned char *ptr = (unsigned char *)cpumask_bits(*mask);
unsigned int tail;
tail = BITS_TO_LONGS(NR_CPUS - nr_cpumask_bits) * sizeof(long);
- memset(cpumask_bits(*mask) + cpumask_size() - tail,
- 0, tail);
+ memset(ptr + cpumask_size() - tail, 0, tail);
}

return *mask != NULL;
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/