From: Seth Jennings <sjenning@linux.vnet.ibm.com>
To: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Cc: Seth Jennings <sjenning@linux.vnet.ibm.com>,
Dan Magenheimer <dan.magenheimer@oracle.com>,
Thadeu Lima de Souza Cascardo <cascardo@holoscopio.com>,
Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>,
Nitin Gupta <ngupta@vflare.org>,
Robert Jennings <rcj@linux.vnet.ibm.com>,
devel@driverdev.osuosl.org, linux-kernel@vger.kernel.org
Subject: [PATCH 2/2] staging: zcache: fix memory corruption bug
Date: Tue, 28 Feb 2012 16:02:23 -0600 [thread overview]
Message-ID: <1330466543-24503-1-git-send-email-sjenning@linux.vnet.ibm.com> (raw)
This patch fixes a bug where the zv code writes before the allocated
buffer, resulting in system memory corruption. This was introduced
during the switch from xvmalloc to zsmalloc.
Signed-off-by: Seth Jennings <sjenning@linux.vnet.ibm.com>
---
drivers/staging/zcache/zcache-main.c | 6 ++----
1 files changed, 2 insertions(+), 4 deletions(-)
diff --git a/drivers/staging/zcache/zcache-main.c b/drivers/staging/zcache/zcache-main.c
index 46c7c04..7073465 100644
--- a/drivers/staging/zcache/zcache-main.c
+++ b/drivers/staging/zcache/zcache-main.c
@@ -701,7 +701,6 @@ static struct zv_hdr *zv_create(struct zs_pool *pool, uint32_t pool_id,
u32 size = clen + sizeof(struct zv_hdr);
int chunks = (size + (CHUNK_SIZE - 1)) >> CHUNK_SHIFT;
void *handle = NULL;
- char *buf;
BUG_ON(!irqs_disabled());
BUG_ON(chunks >= NCHUNKS);
@@ -710,14 +709,13 @@ static struct zv_hdr *zv_create(struct zs_pool *pool, uint32_t pool_id,
goto out;
atomic_inc(&zv_curr_dist_counts[chunks]);
atomic_inc(&zv_cumul_dist_counts[chunks]);
- zv = (struct zv_hdr *)((char *)cdata - sizeof(*zv));
+ zv = zs_map_object(pool, handle);
zv->index = index;
zv->oid = *oid;
zv->pool_id = pool_id;
zv->size = clen;
SET_SENTINEL(zv, ZVH);
- buf = zs_map_object(pool, handle);
- memcpy(buf, zv, clen + sizeof(*zv));
+ memcpy((char *)zv + sizeof(struct zv_hdr), cdata, clen);
zs_unmap_object(pool, handle);
out:
return handle;
--
1.7.5.4
reply other threads:[~2012-02-28 22:03 UTC|newest]
Thread overview: [no followups] expand[flat|nested] mbox.gz Atom feed
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=1330466543-24503-1-git-send-email-sjenning@linux.vnet.ibm.com \
--to=sjenning@linux.vnet.ibm.com \
--cc=cascardo@holoscopio.com \
--cc=dan.magenheimer@oracle.com \
--cc=devel@driverdev.osuosl.org \
--cc=gregkh@linuxfoundation.org \
--cc=konrad.wilk@oracle.com \
--cc=linux-kernel@vger.kernel.org \
--cc=ngupta@vflare.org \
--cc=rcj@linux.vnet.ibm.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).