On Mon, Oct 1, 2018 at 7:31 AM, Jann Horn <jannh@xxxxxxxxxx> wrote:
> commit 7a9cdebdcc17 ("mm: get rid of vmacache_flush_all() entirely")
> removed the VMACACHE_FULL_FLUSHES statistics, but didn't remove the
> corresponding entry in vmstat_text. This causes an out-of-bounds access in
> vmstat_show().
>
> Luckily this only affects kernels with CONFIG_DEBUG_VM_VMACACHE=y, which is
> probably very rare.
>
> Fixes: 7a9cdebdcc17 ("mm: get rid of vmacache_flush_all() entirely")
> Cc: stable@xxxxxxxxxxxxxxx
> Signed-off-by: Jann Horn <jannh@xxxxxxxxxx>
Reviewed-by: Kees Cook <keescook@xxxxxxxxxxxx>
-Kees
> ---
> mm/vmstat.c | 1 -
> 1 file changed, 1 deletion(-)
>
> diff --git a/mm/vmstat.c b/mm/vmstat.c
> index 8ba0870ecddd..4cea7b8f519d 100644
> --- a/mm/vmstat.c
> +++ b/mm/vmstat.c
> @@ -1283,7 +1283,6 @@ const char * const vmstat_text[] = {
> #ifdef CONFIG_DEBUG_VM_VMACACHE
> "vmacache_find_calls",
> "vmacache_find_hits",
> - "vmacache_full_flushes",
> #endif
> #ifdef CONFIG_SWAP
> "swap_ra",
> --
> 2.19.0.605.g01d371f741-goog
>
--
Kees Cook
Pixel Security
