From: Andrew Morton <akpm@linux-foundation.org>
To: akpm@linux-foundation.org, chenjun102@huawei.com,
feng.tang@intel.com, linux-mm@kvack.org, mhocko@suse.com,
mm-commits@vger.kernel.org, rui.xiang@huawei.com,
stable@vger.kernel.org, torvalds@linux-foundation.org,
wangkefeng.wang@huawei.com
Subject: [patch 16/16] mm: fix uninitialized use in overcommit_policy_handler
Date: Fri, 24 Sep 2021 15:44:06 -0700 [thread overview]
Message-ID: <20210924224406.83XR7wX9V%akpm@linux-foundation.org> (raw)
In-Reply-To: <20210924154257.1dbf6699ab8d88c0460f924f@linux-foundation.org>
From: Chen Jun <chenjun102@huawei.com>
Subject: mm: fix uninitialized use in overcommit_policy_handler
We get an unexpected value of /proc/sys/vm/overcommit_memory after running
the following program:
int main()
{
int fd = open("/proc/sys/vm/overcommit_memory", O_RDWR);
write(fd, "1", 1);
write(fd, "2", 1);
close(fd);
}
write(fd, "2", 1) will pass *ppos = 1 to proc_dointvec_minmax.
proc_dointvec_minmax will return 0 without setting new_policy.
t.data = &new_policy;
ret = proc_dointvec_minmax(&t, write, buffer, lenp, ppos)
-->do_proc_dointvec
-->__do_proc_dointvec
if (write) {
if (proc_first_pos_non_zero_ignore(ppos, table))
goto out;
sysctl_overcommit_memory = new_policy;
so sysctl_overcommit_memory will be set to an uninitialized value.
Check whether new_policy has been changed by proc_dointvec_minmax.
Link: https://lkml.kernel.org/r/20210923020524.13289-1-chenjun102@huawei.com
Fixes: 56f3547bfa4d ("mm: adjust vm_committed_as_batch according to vm overcommit policy")
Signed-off-by: Chen Jun <chenjun102@huawei.com>
Acked-by: Michal Hocko <mhocko@suse.com>
Reviewed-by: Feng Tang <feng.tang@intel.com>
Reviewed-by: Kefeng Wang <wangkefeng.wang@huawei.com>
Cc: Rui Xiang <rui.xiang@huawei.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
---
mm/util.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
--- a/mm/util.c~mm-fix-the-uninitialized-use-in-overcommit_policy_handler
+++ a/mm/util.c
@@ -787,7 +787,7 @@ int overcommit_policy_handler(struct ctl
size_t *lenp, loff_t *ppos)
{
struct ctl_table t;
- int new_policy;
+ int new_policy = -1;
int ret;
/*
@@ -805,7 +805,7 @@ int overcommit_policy_handler(struct ctl
t = *table;
t.data = &new_policy;
ret = proc_dointvec_minmax(&t, write, buffer, lenp, ppos);
- if (ret)
+ if (ret || new_policy == -1)
return ret;
mm_compute_batch(new_policy);
_
prev parent reply other threads:[~2021-09-24 22:44 UTC|newest]
Thread overview: 17+ messages / expand[flat|nested] mbox.gz Atom feed top
2021-09-24 22:42 incoming Andrew Morton
2021-09-24 22:43 ` [patch 01/16] mm, hwpoison: add is_free_buddy_page() in HWPoisonHandlable() Andrew Morton
2021-09-24 22:43 ` [patch 02/16] kasan: fix Kconfig check of CC_HAS_WORKING_NOSANITIZE_ADDRESS Andrew Morton
2021-09-24 22:43 ` [patch 03/16] mm/damon: don't use strnlen() with known-bogus source length Andrew Morton
2021-09-24 22:43 ` [patch 04/16] xtensa: increase size of gcc stack frame check Andrew Morton
2021-09-24 22:43 ` [patch 05/16] mm/shmem.c: fix judgment error in shmem_is_huge() Andrew Morton
2021-09-24 22:43 ` [patch 06/16] ocfs2: drop acl cache for directories too Andrew Morton
2021-09-24 22:43 ` [patch 07/16] scripts/sorttable: riscv: fix undeclared identifier 'EM_RISCV' error Andrew Morton
2021-09-24 22:43 ` [patch 08/16] tools/vm/page-types: remove dependency on opt_file for idle page tracking Andrew Morton
2021-09-24 22:43 ` [patch 09/16] lib/zlib_inflate/inffast: check config in C to avoid unused function warning Andrew Morton
2021-09-24 22:43 ` [patch 10/16] mm: fs: invalidate bh_lrus for only cold path Andrew Morton
2021-09-24 22:43 ` [patch 11/16] mm/debug: sync up MR_CONTIG_RANGE and MR_LONGTERM_PIN Andrew Morton
2021-09-24 22:43 ` [patch 12/16] mm/debug: sync up latest migrate_reason to migrate_reason_names Andrew Morton
2021-09-24 22:43 ` [patch 13/16] sh: pgtable-3level: fix cast to pointer from integer of different size Andrew Morton
2021-09-24 22:44 ` [patch 14/16] kasan: always respect CONFIG_KASAN_STACK Andrew Morton
2021-09-24 22:44 ` [patch 15/16] mm/memory_failure: fix the missing pte_unmap() call Andrew Morton
2021-09-24 22:44 ` Andrew Morton [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20210924224406.83XR7wX9V%akpm@linux-foundation.org \
--to=akpm@linux-foundation.org \
--cc=chenjun102@huawei.com \
--cc=feng.tang@intel.com \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-mm@kvack.org \
--cc=mhocko@suse.com \
--cc=mm-commits@vger.kernel.org \
--cc=rui.xiang@huawei.com \
--cc=stable@vger.kernel.org \
--cc=torvalds@linux-foundation.org \
--cc=wangkefeng.wang@huawei.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).