* Usage of get_user_pages() in fs/aio.c
@ 2002-11-06 20:15 Ingo Oeser
2002-11-07 19:46 ` Benjamin LaHaise
0 siblings, 1 reply; 2+ messages in thread
From: Ingo Oeser @ 2002-11-06 20:15 UTC (permalink / raw)
To: Benjamin LaHaise; +Cc: linux-mm
Hi Ben,
in kernel 2.5.46 in file fs/aio.c line 150 you use
get_user_pages() in a way that makes no sense to me.
Your call is:
info->nr_pages = get_user_pages(current, ctx->mm,
info->mmap_base, info->mmap_size,
1, 0, info->ring_pages, NULL);
info->mmap_size contains the number of BYTES mapped by the pages
in the ring_pages ARRAY.
get_user_pages() expects the number of ELEMENTS in the array
instead.
What this can cause is clear ;-)
Simple fix would be to replace "info->mmap_size" with "nr_pages",
that you compute just some lines above.
Please tell me, if I'm wrong here.
Regards
Ingo Oeser
--
Science is what we can tell a computer. Art is everything else. --- D.E.Knuth
--
To unsubscribe, send a message with 'unsubscribe linux-mm' in
the body to majordomo@kvack.org. For more info on Linux MM,
see: http://www.linux-mm.org/
^ permalink raw reply [flat|nested] 2+ messages in thread
* Re: Usage of get_user_pages() in fs/aio.c
2002-11-06 20:15 Usage of get_user_pages() in fs/aio.c Ingo Oeser
@ 2002-11-07 19:46 ` Benjamin LaHaise
0 siblings, 0 replies; 2+ messages in thread
From: Benjamin LaHaise @ 2002-11-07 19:46 UTC (permalink / raw)
To: Ingo Oeser; +Cc: linux-mm
On Wed, Nov 06, 2002 at 09:15:38PM +0100, Ingo Oeser wrote:
> What this can cause is clear ;-)
>
> Simple fix would be to replace "info->mmap_size" with "nr_pages",
> that you compute just some lines above.
Whoops. Yeah, that's a bug. It hasn't actually been noticed in
testing because the array of pages is freshly allocated from mmap
and thus stops filling the array at nr_pages, but it could be
exploited by a hostile user. I'll feed that patch up asap.
-ben
--
"Do you seek knowledge in time travel?"
--
To unsubscribe, send a message with 'unsubscribe linux-mm' in
the body to majordomo@kvack.org. For more info on Linux MM,
see: http://www.linux-mm.org/
^ permalink raw reply [flat|nested] 2+ messages in thread
end of thread, other threads:[~2002-11-07 19:46 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2002-11-06 20:15 Usage of get_user_pages() in fs/aio.c Ingo Oeser
2002-11-07 19:46 ` Benjamin LaHaise
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.