Fix potential crash with sys_move_pages

We incorrectly depended on the 'node_state/node_isset()' functions testing the node range, rather than checking it explicitly. That's not reliable, even if it might often happen to work. So do the proper explicit test. Reported-by: Marcus Meissner <meissner@suse.de> Acked-and-tested-by: Brice Goglin <Brice.Goglin@inria.fr> Acked-by: Hugh Dickins <hugh.dickins@tiscali.co.uk> Cc: stable@kernel.org Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

Fix potential crash with sys_move_pages
We incorrectly depended on the 'node_state/node_isset()' functions testing the node range, rather than checking it explicitly. That's not reliable, even if it might often happen to work. So do the proper explicit test. Reported-by: Marcus Meissner <meissner@suse.de> Acked-and-tested-by: Brice Goglin <Brice.Goglin@inria.fr> Acked-by: Hugh Dickins <hugh.dickins@tiscali.co.uk> Cc: stable@kernel.org Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Linus Torvalds
1 parent 9d9c3a51e7
Showing 1 changed file with 3 additions and 0 deletions Side-by-side Diff
mm/migrate.c
@@ -912,6 +912,9 @@
 				goto out_pm;
  
 			err = -ENODEV;
+			if (node < 0 || node >= MAX_NUMNODES)
+				goto out_pm;
+
 			if (!node_state(node, N_HIGH_MEMORY))
 				goto out_pm;
...	...	@@ -912,6 +912,9 @@
912	912	goto out_pm;
913	913
914	914	err = -ENODEV;
	915	+ if (node < 0 \|\| node >= MAX_NUMNODES)
	916	+ goto out_pm;
	917	+
915	918	if (!node_state(node, N_HIGH_MEMORY))
916	919	goto out_pm;
917	920