You can not select more than 25 topics Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.

William Lee Irwin III cafdd8ba08 [PATCH] try_to_unmap_cluster() passes out-of-bounds pte to pte_unmap() ... try_to_unmap_cluster() does: for (pte = pte_offset_map(pmd, address); address < end; pte++, address += PAGE_SIZE) { ... } pte_unmap(pte); It may take a little staring to notice, but pte can actually fall off the end of the pte page in this iteration, which makes life difficult for kmap_atomic() and the users not expecting it to BUG(). Of course, we're somewhat lucky in that arithmetic elsewhere in the function guarantees that at least one iteration is made, lest this force larger rearrangements to be made. This issue and patch also apply to non-mm mainline and with trivial adjustments, at least two related kernels. Discovered during internal testing at Oracle. Signed-off-by: William Irwin <wli@holomorphy.com> Signed-off-by: Andrew Morton <akpm@osdl.org> Signed-off-by: Linus Torvalds <torvalds@osdl.org>		20 years ago
..
Makefile	Linux-2.6.12-rc2	20 years ago
bootmem.c	Linux-2.6.12-rc2	20 years ago
fadvise.c	Linux-2.6.12-rc2	20 years ago
filemap.c	[PATCH] fix for __generic_file_aio_read() to return 0 on EOF	20 years ago
fremap.c	Linux-2.6.12-rc2	20 years ago
highmem.c	[PATCH] count bounce buffer pages in vmstat	20 years ago
hugetlb.c	Linux-2.6.12-rc2	20 years ago
internal.h	Linux-2.6.12-rc2	20 years ago
madvise.c	Linux-2.6.12-rc2	20 years ago
memory.c	[PATCH] do_swap_page() can map random data if swap read fails	20 years ago
mempolicy.c	[PATCH] mempolicy.c GFP fix	20 years ago
mempool.c	[PATCH] use smp_mb/wmb/rmb where possible	20 years ago
mincore.c	[PATCH] freepgt: sys_mincore ignore FIRST_USER_PGD_NR	20 years ago
mlock.c	Linux-2.6.12-rc2	20 years ago
mmap.c	Fix get_unmapped_area sanity tests	20 years ago
mprotect.c	Linux-2.6.12-rc2	20 years ago
mremap.c	[PATCH] mm acct accounting fix	20 years ago
msync.c	Linux-2.6.12-rc2	20 years ago
nommu.c	[PATCH] mm/nommu.c: try to fix __vmalloc	20 years ago
oom_kill.c	[PATCH] oom-killer disable for iscsi/lvm2/multipath userland critical sections	20 years ago
page-writeback.c	[PATCH] DocBook: fix some descriptions	20 years ago
page_alloc.c	[IA64] Export node_online_map and node_possible_map	20 years ago
page_io.c	Linux-2.6.12-rc2	20 years ago
pdflush.c	Linux-2.6.12-rc2	20 years ago
prio_tree.c	Linux-2.6.12-rc2	20 years ago
readahead.c	Linux-2.6.12-rc2	20 years ago
rmap.c	[PATCH] try_to_unmap_cluster() passes out-of-bounds pte to pte_unmap()	20 years ago
shmem.c	Linux-2.6.12-rc2	20 years ago
slab.c	[PATCH] Change synchronize_kernel to _rcu and _sched	20 years ago
swap.c	Linux-2.6.12-rc2	20 years ago
swap_state.c	[PATCH] mm: use __GFP_NOMEMALLOC	20 years ago
swapfile.c	[PATCH] swapout oops fix	20 years ago
thrash.c	Linux-2.6.12-rc2	20 years ago
tiny-shmem.c	Linux-2.6.12-rc2	20 years ago
truncate.c	[PATCH] DocBook: fix some descriptions	20 years ago
vmalloc.c	[PATCH] x86_64: Fixed guard page handling again in iounmap	20 years ago
vmscan.c	[PATCH] vmscan: pageout(): remove unneeded test	20 years ago