diff options
author | Paul Jackson <pj@sgi.com> | 2007-06-16 10:16:01 -0700 |
---|---|---|
committer | Linus Torvalds <torvalds@woody.linux-foundation.org> | 2007-06-16 13:16:15 -0700 |
commit | 3e903e7b1605aff88d7f89a96fab5e43081b914f (patch) | |
tree | ae35423c1643689f27734005f39cebe52773962d /drivers/acpi | |
parent | d6f8bb1310d4745ff1d0c74eeacae31e2a3eeff1 (diff) | |
download | kernel_samsung_smdk4412-3e903e7b1605aff88d7f89a96fab5e43081b914f.zip kernel_samsung_smdk4412-3e903e7b1605aff88d7f89a96fab5e43081b914f.tar.gz kernel_samsung_smdk4412-3e903e7b1605aff88d7f89a96fab5e43081b914f.tar.bz2 |
cpuset: zero malloc - fix for old cpusets
The cpuset code to present a list of tasks using a cpuset to user space could
write to an array that it had kmalloc'd, after a kmalloc request of zero size.
The problem was that the code didn't check for writes past the allocated end
of the array until -after- the first write.
This is a race condition that is likely rare -- it would only show up if a
cpuset went from being empty to having a task in it, during the brief time
between the allocation and the first write.
Prior to roughly 2.6.22 kernels, this was also a benign problem, because a
zero kmalloc returned a few usable bytes anyway, and no harm was done with the
bogus write.
With the 2.6.22 kernel changes to make issue a warning if code tries to write
to the location returned from a zero size allocation, this problem is no
longer benign. This cpuset code would occassionally trigger that warning.
The fix is trivial -- check before storing into the array, not after, whether
the array is big enough to hold the store.
Cc: "Eric W. Biederman" <ebiederm@xmission.com>
Cc: "Serge E. Hallyn" <serue@us.ibm.com>
Cc: Balbir Singh <balbir@in.ibm.com>
Cc: Dave Hansen <haveblue@us.ibm.com>
Cc: Herbert Poetzl <herbert@13thfloor.at>
Cc: Kirill Korotaev <dev@openvz.org>
Cc: Paul Menage <menage@google.com>
Cc: Srivatsa Vaddagiri <vatsa@in.ibm.com>
Cc: Christoph Lameter <clameter@sgi.com>
Signed-off-by: Paul Jackson <pj@sgi.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Diffstat (limited to 'drivers/acpi')
0 files changed, 0 insertions, 0 deletions