[PATCH] IPC: access to unmapped vmalloc area in grow_ary()

grow_ary() should not copy struct ipc_id_ary (it copies new->p, not new). Due to this, memcpy() src pointer could hit unmapped vmalloc page when near page boundary.

Found during OpenVZ stress testing

Signed-Off-By: Alexey Kuznetsov <[email protected]>
Signed-Off-By: Kirill Korotaev <[email protected]>

diff -urp ../git/linux-2.6.16-workgpl/ipc/util.c linux-2.6.16/ipc/util.c
--- ../git/linux-2.6.16-workgpl/ipc/util.c	2006-04-13 16:01:47.000000000 +0400
+++ linux-2.6.16/ipc/util.c	2006-04-13 16:01:05.000000000 +0400
@@ -187,8 +187,7 @@ static int grow_ary(struct ipc_ids* ids,
 	if(new == NULL)
 		return size;
 	new->size = newsize;
-	memcpy(new->p, ids->entries->p, sizeof(struct kern_ipc_perm *)*size +
-					sizeof(struct ipc_id_ary));
+	memcpy(new->p, ids->entries->p, sizeof(struct kern_ipc_perm *)*size);
 	for(i=size;i<newsize;i++) {
 		new->p[i] = NULL;
 	}

---

• Prev by Date: Re: Is notify_die being overloaded?
• Next by Date: Re: [PATCH 00/05] robust per_cpu allocation for modules
• Previous by thread: 2.6.16.1 psmouse.c: TouchPad at isa0060/serio4/input0 lost sync at byte 1 and ACPI
• Next by thread: [PATCH][x86_64] IPI calltraces on x86_64
• Index(es):
  • Date
  • Thread

[Index of Archives]     [Kernel Newbies]     [Netfilter]     [Bugtraq]     [Photo]     [Stuff]     [Gimp]     [Yosemite News]     [MIPS Linux]     [ARM Linux]     [Linux Security]     [Linux RAID]     [Video 4 Linux]     [Linux for the blind]     [Linux Resources]