The patch titled
Do proper boundary checking in sys_swapon()
has been added to the -mm tree. Its filename is
do-proper-boundary-checking-in-sys_swapon.patch
See http://www.zip.com.au/~akpm/linux/patches/stuff/added-to-mm.txt to find
out what to do about this
------------------------------------------------------
Subject: Do proper boundary checking in sys_swapon()
From: Christoph Lameter <clameter@xxxxxxx>
sys_swapon currently does not limit the number of swap devices. It may as
a result overwrite memory following the swap_info array and get into
entanglements with page migration since it may usethe swap types reserved
for page migration.
Fix this by limiting the number of swap devices in swapon to MAX_SWAPFILES
Signed-off-by: Christoph Lameter <clameter@xxxxxxx>
Cc: Hugh Dickins <hugh@xxxxxxxxxxx>
Signed-off-by: Andrew Morton <akpm@xxxxxxxx>
---
mm/swapfile.c | 7 ++++++-
1 file changed, 6 insertions(+), 1 deletion(-)
diff -puN mm/swapfile.c~do-proper-boundary-checking-in-sys_swapon mm/swapfile.c
--- devel/mm/swapfile.c~do-proper-boundary-checking-in-sys_swapon 2006-06-05 13:55:15.000000000 -0700
+++ devel-akpm/mm/swapfile.c 2006-06-05 13:55:15.000000000 -0700
@@ -1419,8 +1419,13 @@ asmlinkage long sys_swapon(const char __
spin_unlock(&swap_lock);
goto out;
}
- if (type >= nr_swapfiles)
+ if (type >= nr_swapfiles) {
+ if (nr_swapfiles >= MAX_SWAPFILES) {
+ spin_unlock(&swap_lock);
+ goto out;
+ }
nr_swapfiles = type+1;
+ }
INIT_LIST_HEAD(&p->extent_list);
p->flags = SWP_USED;
p->swap_file = NULL;
_
Patches currently in -mm which might be from clameter@xxxxxxx are
do-proper-boundary-checking-in-sys_swapon.patch
page-migration-make-do_swap_page-redo-the-fault.patch
slab-extract-cache_free_alien-from-__cache_free.patch
migration-remove-unnecessary-pageswapcache-checks.patch
page-migration-cleanup-rename-ignrefs-to-migration.patch
page-migration-cleanup-group-functions.patch
page-migration-cleanup-remove-useless-definitions.patch
page-migration-cleanup-drop-nr_refs-in-remove_references.patch
page-migration-cleanup-extract-try_to_unmap-from-migration-functions.patch
page-migration-cleanup-pass-mapping-to-migration-functions.patch
page-migration-cleanup-move-fallback-handling-into-special-function.patch
swapless-pm-add-r-w-migration-entries.patch
swapless-page-migration-rip-out-swap-based-logic.patch
swapless-page-migration-modify-core-logic.patch
more-page-migration-do-not-inc-dec-rss-counters.patch
more-page-migration-use-migration-entries-for-file-pages.patch
page-migration-update-documentation.patch
mm-remove-vm_locked-before-remap_pfn_range-and-drop-vm_shm.patch
page-migration-simplify-migrate_pages.patch
page-migration-simplify-migrate_pages-tweaks.patch
page-migration-handle-freeing-of-pages-in-migrate_pages.patch
page-migration-use-allocator-function-for-migrate_pages.patch
page-migration-support-moving-of-individual-pages.patch
page-migration-detailed-status-for-moving-of-individual-pages.patch
page-migration-support-moving-of-individual-pages-fixes.patch
page-migration-support-moving-of-individual-pages-x86_64-support.patch
page-migration-support-moving-of-individual-pages-x86-support.patch
page-migration-support-a-vma-migration-function.patch
allow-migration-of-mlocked-pages.patch
cpuset-remove-extra-cpuset_zone_allowed-check-in-__alloc_pages.patch
-
To unsubscribe from this list: send the line "unsubscribe mm-commits" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at http://vger.kernel.org/majordomo-info.html
