[PATCH] IPC: access to unmapped vmalloc area in grow_ary()
authorAlexey Kuznetsov <kuznet@ms2.inr.ac.ru>
Mon, 17 Apr 2006 11:39:23 +0000 (15:39 +0400)
committerLinus Torvalds <torvalds@g5.osdl.org>
Tue, 18 Apr 2006 01:40:40 +0000 (18:40 -0700)
grow_ary() should not copy struct ipc_id_ary (it copies new->p, not
new). Due to this, memcpy() src pointer could hit unmapped vmalloc page
when near page boundary.

Found during OpenVZ stress testing

Signed-off-by: Alexey Kuznetsov <kuznet@ms2.inr.ac.ru>
Signed-off-by: Kirill Korotaev <dev@openvz.org>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>
ipc/util.c

index 5e785a29e1e63349ff35f8a1b3282f468fd24277..b3dcfad3b4f72075b7c338dc182eeb0c2403d482 100644 (file)
@@ -183,8 +183,7 @@ static int grow_ary(struct ipc_ids* ids, int newsize)
        if(new == NULL)
                return size;
        new->size = newsize;
-       memcpy(new->p, ids->entries->p, sizeof(struct kern_ipc_perm *)*size +
-                                       sizeof(struct ipc_id_ary));
+       memcpy(new->p, ids->entries->p, sizeof(struct kern_ipc_perm *)*size);
        for(i=size;i<newsize;i++) {
                new->p[i] = NULL;
        }