From: Neil Booth <NeilB@earthling.net>
To: Linus Torvalds <torvalds@transmeta.com>
Cc: Alan Cox <alan@lxorguk.ukuu.org.uk>, linux-mm@kvack.org
Subject: PATCH - bug in vfree
Date: Sat, 20 Feb 1999 20:46:29 +0900 [thread overview]
Message-ID: <36CEA095.D5EA37B5@earthling.net> (raw)
[-- Attachment #1: Type: text/plain, Size: 1150 bytes --]
Linus,
I posted this bug on the kernel mailing list last year, but it never got
fixed, probably as I didn't include a patch. I attach a patch this time
against kernel 2.2.1. The bug is rare, but can lead to kernel virtual
memory corruption.
Quick description:- vfree forgets to subtract the extra cushion page
from the size of each virtual memory area stored in vmlist when it calls
vmfree_area_pages. This means that only the vmalloc-requested size is
allocated by vmalloc_area_pages, but the requested size PLUS the cushion
page is freed by vmfree_area_pages.
More deeply:- Close inspection of get_vm_area reveals that
(intentionally?) it does NOT insist there be a cushion page behind a VMA
that is placed in front of a previously-allocated VMA, it ONLY
guarantees that a cushion page lies in front of newly-allocated VMAs.
Thus two VMAs could be immediately adjacent without a cushion page, and
coupled with the vfree bug means that vfree-ing the first VMA also frees
the first page of the second VMA, with dire consequences.
I have described this as clearly as I can, I hope it makes sense. Alan,
this same bug also exists in 2.0.36.
Neil.
[-- Attachment #2: vfree-patch --]
[-- Type: text/plain, Size: 384 bytes --]
--- linux/mm/vmalloc.c~ Sun Jan 24 19:21:06 1999
+++ linux/mm/vmalloc.c Sat Feb 20 20:17:11 1999
@@ -187,7 +187,7 @@
for (p = &vmlist ; (tmp = *p) ; p = &tmp->next) {
if (tmp->addr == addr) {
*p = tmp->next;
- vmfree_area_pages(VMALLOC_VMADDR(tmp->addr), tmp->size);
+ vmfree_area_pages(VMALLOC_VMADDR(tmp->addr), tmp->size - PAGE_SIZE);
kfree(tmp);
return;
}
next reply other threads:[~1999-02-20 11:44 UTC|newest]
Thread overview: 5+ messages / expand[flat|nested] mbox.gz Atom feed top
1999-02-20 11:46 Neil Booth [this message]
1999-02-20 12:14 ` PATCH - bug in vfree Neil Booth
1999-02-27 2:39 ` Neil Booth
1999-02-22 20:31 ` Kanoj Sarcar
1999-02-25 0:47 ` Andrea Arcangeli
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=36CEA095.D5EA37B5@earthling.net \
--to=neilb@earthling.net \
--cc=alan@lxorguk.ukuu.org.uk \
--cc=linux-mm@kvack.org \
--cc=torvalds@transmeta.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.