Doug / smarc-fsl-linux-kernel

Download as
Browse Code ยป

Commit a9a5cd5d2a57fb76dbae2115450f777b69beccf7

Authored by Alexey Kuznetsov
Committed by Linus Torvalds
1 parent 69cf0fac60
Exists in master and in 7 other branches imx_3.0.35_4.1.0, imx_3.10.17_1.0.1_ga, imx_3.10.53_1.1.0_ga, imx_3.14.28_1.0.0_ga, smarc-imx_3.10.53_1.1.0_ga, smarc-imx_3.14.28_1.0.0_ga, smarc-l5.0.0_1.0.0-ga

[PATCH] IPC: access to unmapped vmalloc area in grow_ary() 

grow_ary() should not copy struct ipc_id_ary (it copies new->p, not
new). Due to this, memcpy() src pointer could hit unmapped vmalloc page
when near page boundary.

Found during OpenVZ stress testing

Signed-off-by: Alexey Kuznetsov <kuznet@ms2.inr.ac.ru>
Signed-off-by: Kirill Korotaev <dev@openvz.org>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>

Showing 1 changed file with 1 additions and 2 deletions Side-by-side Diff

... ... @@ -183,8 +183,7 @@
183 183 if(new == NULL)
184 184 return size;
185 185 new->size = newsize;
186   - memcpy(new->p, ids->entries->p, sizeof(struct kern_ipc_perm *)*size +
187   - sizeof(struct ipc_id_ary));
  186 + memcpy(new->p, ids->entries->p, sizeof(struct kern_ipc_perm *)*size);
188 187 for(i=size;i<newsize;i++) {
189 188 new->p[i] = NULL;
190 189 }