The patch titled
cpuset: zero malloc - revert the old cpuset fix
has been removed from the -mm tree. Its filename was
cpuset-zero-malloc-revert-the-old-cpuset-fix.patch
This patch was dropped because it was merged into mainline or a subsystem tree
------------------------------------------------------
Subject: cpuset: zero malloc - revert the old cpuset fix
From: Paul Jackson <pj@xxxxxxx>
The cpuset code to present a list of tasks using a cpuset to user space could
write to an array that it had kmalloc'd, after a kmalloc request of zero size.
The problem was that the code didn't check for writes past the allocated end
of the array until -after- the first write.
This is a race condition that is likely rare -- it would only show up if a
cpuset went from being empty to having a task in it, during the brief time
between the allocation and the first write.
Prior to roughly 2.6.22 kernels, this was also a benign problem, because a
zero kmalloc returned a few usable bytes anyway, and no harm was done with the
bogus write.
With the 2.6.22 kernel changes to make issue a warning if code tries to write
to the location returned from a zero size allocation, this problem is no
longer benign. This cpuset code would occassionally trigger that warning.
The fix is trivial -- check before storing into the array, not after, whether
the array is big enough to hold the store.
Cc: "Eric W. Biederman" <ebiederm@xxxxxxxxxxxx>
Cc: "Serge E. Hallyn" <serue@xxxxxxxxxx>
Cc: Balbir Singh <balbir@xxxxxxxxxx>
Cc: Dave Hansen <haveblue@xxxxxxxxxx>
Cc: Herbert Poetzl <herbert@xxxxxxxxxxxx>
Cc: Kirill Korotaev <dev@xxxxxxxxxx>
Cc: Paul Menage <menage@xxxxxxxxxx>
Cc: Srivatsa Vaddagiri <vatsa@xxxxxxxxxx>
Cc: Christoph Lameter <clameter@xxxxxxx>
Signed-off-by: Paul Jackson <pj@xxxxxxx>
Signed-off-by: Andrew Morton <akpm@xxxxxxxxxxxxxxxxxxxx>
---
kernel/cpuset.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff -puN kernel/cpuset.c~cpuset-zero-malloc-revert-the-old-cpuset-fix kernel/cpuset.c
--- a/kernel/cpuset.c~cpuset-zero-malloc-revert-the-old-cpuset-fix
+++ a/kernel/cpuset.c
@@ -1638,9 +1638,9 @@ static int pid_array_load(pid_t *pidarra
do_each_thread(g, p) {
if (p->cpuset == cs) {
+ pidarray[n++] = p->pid;
if (unlikely(n == npids))
goto array_full;
- pidarray[n++] = p->pid;
}
} while_each_thread(g, p);
_
Patches currently in -mm which might be from pj@xxxxxxx are
origin.patch
git-scsi-misc.patch
-
To unsubscribe from this list: send the line "unsubscribe mm-commits" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at http://vger.kernel.org/majordomo-info.html
