DescriptionEugene Teo (Security Response)
2011-10-21 06:33:19 UTC
When m_start returns an error, the seq_file logic will still call m_stop
with that error entry, so we'd better make sure that we check it before
using it as a vma.
Introduced by commit ec6fd8a4355c ("report errors in /proc/*/*map*
sanely"), which replaced NULL with various ERR_PTR() cases.
(On ia64, you happen to get a unaligned fault instead of a page fault,
since the address used is generally some random error code like -EPERM)
Upstream commit:
http://git.kernel.org/linus/76597cd31470fa130784c78fadb4dab2e624a723
Comment 2Eugene Teo (Security Response)
2011-10-21 06:53:52 UTC
When m_start returns an error, the seq_file logic will still call m_stop with that error entry, so we'd better make sure that we check it before using it as a vma. Introduced by commit ec6fd8a4355c ("report errors in /proc/*/*map* sanely"), which replaced NULL with various ERR_PTR() cases. (On ia64, you happen to get a unaligned fault instead of a page fault, since the address used is generally some random error code like -EPERM) Upstream commit: http://git.kernel.org/linus/76597cd31470fa130784c78fadb4dab2e624a723