From: Paul Jackson <[email protected]>
Third of three -- This applies after the container patches,
fixing a problem that earlier patches also fixed in the older
cpuset code.
The container code to present a list of tasks using a container
to user space could write to an array that it had kmalloc'd,
after a kmalloc request of zero size.
The problem was that the code didn't check for writes past the
allocated end of the array until -after- the first write.
This is a race condition that is likely rare -- it would only show
up if a container went from being empty to having a task in it,
during the brief time between the allocation and the first write.
Prior to roughly 2.6.22 kernels, this was also a benign problem,
because a zero kmalloc returned a few usable bytes anyway,
and no harm was done with the bogus write.
With the 2.6.22 kernel changes to make issue a warning if
code tries to write to the location returned from a zero size
allocation, this problem is no longer benign. This container code
would occassionally trigger that warning.
The fix is trivial -- check before storing into the array,
not after, whether the array is big enough to hold the store.
Cc: "Eric W. Biederman" <[email protected]>
Cc: "Serge E. Hallyn" <[email protected]>
Cc: Balbir Singh <[email protected]>
Cc: Dave Hansen <[email protected]>
Cc: Herbert Poetzl <[email protected]>
Cc: Kirill Korotaev <[email protected]>
Cc: Paul Menage <[email protected]>
Cc: Srivatsa Vaddagiri <[email protected]>
Cc: Christoph Lameter <[email protected]>
Signed-off-by: Paul Jackson <[email protected]>
---
Andrew - this is the third of three similar patches. This one
redoes the fix for the container code.
Please apply somewhere after:
containersv10-share-css_group-arrays-between-tasks-with-same-container-memberships.patch
kernel/container.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- 2.6.22-rc4-mm2.orig/kernel/container.c 2007-06-08 15:36:14.997835546 -0700
+++ 2.6.22-rc4-mm2/kernel/container.c 2007-06-08 15:37:09.606655972 -0700
@@ -1451,9 +1451,9 @@ static int pid_array_load(pid_t *pidarra
struct task_struct *tsk;
container_iter_start(cont, &it);
while ((tsk = container_iter_next(cont, &it))) {
- pidarray[n++] = pid_nr(task_pid(tsk));
if (unlikely(n == npids))
break;
+ pidarray[n++] = pid_nr(task_pid(tsk));
}
container_iter_end(cont, &it);
return n;
--
I won't rest till it's the best ...
Programmer, Linux Scalability
Paul Jackson <[email protected]> 1.650.933.1373
-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to [email protected]
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/
[Index of Archives]
[Kernel Newbies]
[Netfilter]
[Bugtraq]
[Photo]
[Stuff]
[Gimp]
[Yosemite News]
[MIPS Linux]
[ARM Linux]
[Linux Security]
[Linux RAID]
[Video 4 Linux]
[Linux for the blind]
[Linux Resources]
