Attachment 313298 Details for Bug 457703 – Proposed backported patch for MRG kernel

[patch] Proposed backported patch for MRG kernel

patch (text/plain), 1.44 KB, created by Eugene Teo (Security Response) on 2008-08-04 03:29:43 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Eugene Teo (Security Response)

Created: 2008-08-04 03:29:43 UTC

Size: 1.44 KB

patch

obsolete

>[mrg-1] kernel: fix off-by-one error in iov_iter_advance()
>
>This is for bz#457705
>
>Backport of upstream commit 94ad374a0751f40d25e22e036c37f7263569d24c
>
>Brew build: http://brewweb.devel.redhat.com/brew/taskinfo?taskID=1419736
>
>The iov_iter_advance() function would look at the iov->iov_len entry
>even though it might have iterated over the whole array, and iov was
>pointing past the end.  This would cause DEBUG_PAGEALLOC to trigger a
>kernel page fault if the allocation was at the end of a page, and the
>next page was unallocated.
>
>The quick fix is to just change the order of the tests: check that there
>is any iovec data left before we check the iov entry itself.
>
>Thanks to Alexey Dobriyan for finding this case, and testing the fix.
>
>Signed-off-by: Eugene Teo <eteo@redhat.com>
>---
> mm/filemap.c |    2 +-
> 1 file changed, 1 insertion(+), 1 deletion(-)
>
>diff -uprN linux-2.6.24.7.noarch.default/mm/filemap.c linux-2.6.24.7.noarch/mm/filemap.c
>--- linux-2.6.24.7.noarch.default/mm/filemap.c	2008-08-02 23:49:03.000000000 +0800
>+++ linux-2.6.24.7.noarch/mm/filemap.c	2008-08-04 11:10:49.000000000 +0800
>@@ -1825,7 +1825,7 @@ void iov_iter_advance(struct iov_iter *i
> 		 * The !iov->iov_len check ensures we skip over unlikely
> 		 * zero-length segments (without overruning the iovec).
> 		 */
>-		while (bytes || unlikely(!iov->iov_len && i->count)) {
>+		while (bytes || unlikely(i->count && !iov->iov_len)) {
> 			int copy;
> 
> 			copy = min(bytes, iov->iov_len - base);

Actions: View | Diff

Attachments on bug 457703: 313297 | 313298