• P
    cpuset: zero malloc - revert the old cpuset fix · 55a230aa
    Paul Jackson 提交于
    The cpuset code to present a list of tasks using a cpuset to user space could
    write to an array that it had kmalloc'd, after a kmalloc request of zero size.
    
    The problem was that the code didn't check for writes past the allocated end
    of the array until -after- the first write.
    
    This is a race condition that is likely rare -- it would only show up if a
    cpuset went from being empty to having a task in it, during the brief time
    between the allocation and the first write.
    
    Prior to roughly 2.6.22 kernels, this was also a benign problem, because a
    zero kmalloc returned a few usable bytes anyway, and no harm was done with the
    bogus write.
    
    With the 2.6.22 kernel changes to make issue a warning if code tries to write
    to the location returned from a zero size allocation, this problem is no
    longer benign.  This cpuset code would occassionally trigger that warning.
    
    The fix is trivial -- check before storing into the array, not after, whether
    the array is big enough to hold the store.
    
    Cc: "Eric W. Biederman" <ebiederm@xmission.com>
    Cc: "Serge E. Hallyn" <serue@us.ibm.com>
    Cc: Balbir Singh <balbir@in.ibm.com>
    Cc: Dave Hansen <haveblue@us.ibm.com>
    Cc: Herbert Poetzl <herbert@13thfloor.at>
    Cc: Kirill Korotaev <dev@openvz.org>
    Cc: Paul Menage <menage@google.com>
    Cc: Srivatsa Vaddagiri <vatsa@in.ibm.com>
    Cc: Christoph Lameter <clameter@sgi.com>
    Signed-off-by: NPaul Jackson <pj@sgi.com>
    Signed-off-by: NAndrew Morton <akpm@linux-foundation.org>
    Signed-off-by: NLinus Torvalds <torvalds@linux-foundation.org>
    55a230aa
cpuset.c 76.7 KB