FAQ Search Today's Posts Mark Forums Read
» Video Reviews

» Linux Archive

Linux-archive is a website aiming to archive linux email lists and to make them easily accessible for linux users/developers.


» Sponsor

» Partners

» Sponsor

Go Back   Linux Archive > Ubuntu > Ubuntu Kernel Team

 
 
LinkBack Thread Tools
 
Old 04-13-2011, 03:07 PM
Linus Torvalds
 
Default vm: fix vm_pgoff wrap in stack expansion, CVE-2011-2=

BugLink: http://bugs.launchpad.net/bugs/869243
CVE-2011-2496

Commit 982134ba6261 ("mm: avoid wrapping vm_pgoff in mremap()") fixed
the case of a expanding mapping causing vm_pgoff wrapping when you used
mremap. But there was another case where we expand mappings hiding in
plain sight: the automatic stack expansion.

This fixes that case too.

This one also found by Robert =C5=9Awi=C4=99cki, using his nasty system c=
all
fuzzer tool. Good job.

Reported-and-tested-by: Robert =C5=9Awi=C4=99cki <robert@swiecki.net>
Cc: stable@kernel.org
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

Backported from a626ca6a656450e9f4df91d0dda238fff23285f4
Acked-by: Stefan Bader <stefan.bader@canonical.com>
Signed-off-by: Paolo Pisati <paolo.pisati@canonical.com>
Signed-off-by: Tim Gardner <tim.gardner@canonical.com>
---
mm/mmap.c | 11 +++++++----
1 files changed, 7 insertions(+), 4 deletions(-)

diff --git a/mm/mmap.c b/mm/mmap.c
index 974ecc0..dcd3dcc 100644
--- a/mm/mmap.c
+++ b/mm/mmap.c
@@ -1644,10 +1644,13 @@ static inline int expand_downwards(struct vm_area=
_struct *vma,
size =3D vma->vm_end - address;
grow =3D (vma->vm_start - address) >> PAGE_SHIFT;
=20
- error =3D acct_stack_growth(vma, size, grow);
- if (!error) {
- vma->vm_start =3D address;
- vma->vm_pgoff -=3D grow;
+ error =3D -ENOMEM;
+ if (grow <=3D vma->vm_pgoff) {
+ error =3D acct_stack_growth(vma, size, grow);
+ if (!error) {
+ vma->vm_start =3D address;
+ vma->vm_pgoff -=3D grow;
+ }
}
}
anon_vma_unlock(vma);
--=20
1.7.1


--------------070807070704070205020206
Content-Type: text/x-patch;
name="0003-vm-fix-vm_pgoff-wrap-in-upward-expansion-CVE-2011-24.patch"
Content-Transfer-Encoding: 7bit
Content-Disposition: attachment;
filename*0="0003-vm-fix-vm_pgoff-wrap-in-upward-expansion-CVE-2011-24.pa";
filename*1="tch"
 

Thread Tools




All times are GMT. The time now is 01:53 PM.

VBulletin, Copyright ©2000 - 2014, Jelsoft Enterprises Ltd.
Content Relevant URLs by vBSEO ©2007, Crawlability, Inc.
Copyright 2007 - 2008, www.linux-archive.org