summaryrefslogtreecommitdiff
path: root/kernel
diff options
context:
space:
mode:
authorPaul Jackson <pj@sgi.com>2007-10-18 23:39:28 -0700
committerLinus Torvalds <torvalds@woody.linux-foundation.org>2007-10-19 11:53:35 -0700
commit55a230aae650157720becc09cadb7d10efbf5013 (patch)
treea4d85dd865c4e939580fdde986a0d29912e45a7e /kernel
parent8f731f7d83d6c6a3eeb32cce79bfcddbf7fac8cc (diff)
cpuset: zero malloc - revert the old cpuset fix
The cpuset code to present a list of tasks using a cpuset to user space could write to an array that it had kmalloc'd, after a kmalloc request of zero size. The problem was that the code didn't check for writes past the allocated end of the array until -after- the first write. This is a race condition that is likely rare -- it would only show up if a cpuset went from being empty to having a task in it, during the brief time between the allocation and the first write. Prior to roughly 2.6.22 kernels, this was also a benign problem, because a zero kmalloc returned a few usable bytes anyway, and no harm was done with the bogus write. With the 2.6.22 kernel changes to make issue a warning if code tries to write to the location returned from a zero size allocation, this problem is no longer benign. This cpuset code would occassionally trigger that warning. The fix is trivial -- check before storing into the array, not after, whether the array is big enough to hold the store. Cc: "Eric W. Biederman" <ebiederm@xmission.com> Cc: "Serge E. Hallyn" <serue@us.ibm.com> Cc: Balbir Singh <balbir@in.ibm.com> Cc: Dave Hansen <haveblue@us.ibm.com> Cc: Herbert Poetzl <herbert@13thfloor.at> Cc: Kirill Korotaev <dev@openvz.org> Cc: Paul Menage <menage@google.com> Cc: Srivatsa Vaddagiri <vatsa@in.ibm.com> Cc: Christoph Lameter <clameter@sgi.com> Signed-off-by: Paul Jackson <pj@sgi.com> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Diffstat (limited to 'kernel')
-rw-r--r--kernel/cpuset.c2
1 files changed, 1 insertions, 1 deletions
diff --git a/kernel/cpuset.c b/kernel/cpuset.c
index 64950fa5d321..a40a2c4384b3 100644
--- a/kernel/cpuset.c
+++ b/kernel/cpuset.c
@@ -1638,9 +1638,9 @@ static int pid_array_load(pid_t *pidarray, int npids, struct cpuset *cs)
do_each_thread(g, p) {
if (p->cpuset == cs) {
+ pidarray[n++] = p->pid;
if (unlikely(n == npids))
goto array_full;
- pidarray[n++] = p->pid;
}
} while_each_thread(g, p);