Stephen Rothwell 8ce08464d2 [PATCH] Fix sys_move_pages when a NULL node list is passed ... sys_move_pages() uses vmalloc() to allocate an array of structures that is fills with information passed from user mode and then passes to do_stat_pages() (in the case the node list is NULL). do_stat_pages() depends on a marker in the node field of the structure to decide how large the array is and this marker is correctly inserted into the last element of the array. However, vmalloc() doesn't zero the memory it allocates and if the user passes NULL for the node list, then the node fields are not filled in (except for the end marker). If the memory the vmalloc() returned happend to have a word with the marker value in it in just the right place, do_pages_stat will fail to fill the status field of part of the array and we will return (random) kernel data to user mode. Signed-off-by: Stephen Rothwell <sfr@canb.auug.org.au> Cc: Christoph Lameter <clameter@engr.sgi.com> Cc: <stable@kernel.org> Signed-off-by: Andrew Morton <akpm@osdl.org> Signed-off-by: Linus Torvalds <torvalds@osdl.org>		2006-11-03 12:27:59 -08:00
..
Kconfig	Fix "can not" in Documentation and Kconfig	2006-10-03 22:53:09 +02:00
Makefile	[PATCH] separate bdi congestion functions from queue congestion functions	2006-10-20 10:26:35 -07:00
allocpercpu.c	[PATCH] Extract the allocpercpu functions from the slab allocator	2006-09-26 08:48:51 -07:00
backing-dev.c	[PATCH] separate bdi congestion functions from queue congestion functions	2006-10-20 10:26:35 -07:00
bootmem.c	[PATCH] bootmem: use MAX_DMA_ADDRESS instead of LOW32LIMIT	2006-09-26 08:48:49 -07:00
bounce.c	[PATCH] BLOCK: Separate the bounce buffering code from the highmem code [try #6]	2006-09-30 20:32:11 +02:00
fadvise.c	[PATCH] fadvise() make POSIX_FADV_NOREUSE a no-op	2006-08-06 08:57:47 -07:00
filemap.c	[PATCH] mm: clean up pagecache allocation	2006-10-28 11:30:50 -07:00
filemap.h	Remove all inclusions of <linux/config.h>	2006-10-04 03:38:54 -04:00
filemap_xip.c	[PATCH] mark address_space_operations const	2006-06-28 14:59:04 -07:00
fremap.c	[PATCH] paravirt: pte clear not present	2006-10-01 00:39:33 -07:00
highmem.c	[PATCH] BLOCK: Separate the bounce buffering code from the highmem code [try #6]	2006-09-30 20:32:11 +02:00
hugetlb.c	[PATCH] hugetlb: fix absurd HugePages_Rsvd	2006-10-28 11:30:53 -07:00
internal.h	[PATCH] mm: VM_BUG_ON	2006-09-26 08:48:44 -07:00
madvise.c	[PATCH] Fix MADV_REMOVE protection checking	2006-04-17 18:22:18 -07:00
memory.c	[PATCH] mm: D-cache aliasing issue in cow_user_page	2006-10-20 10:26:43 -07:00
memory_hotplug.c	[PATCH] hot-add-mem x86_64: use CONFIG_MEMORY_HOTPLUG_RESERVE	2006-10-01 00:39:18 -07:00
mempolicy.c	[PATCH] Fix do_mbind warning with CONFIG_MIGRATION=n	2006-10-11 11:14:19 -07:00
mempool.c	[PATCH] dm: work around mempool_alloc, bio_alloc_bioset deadlocks	2006-09-01 11:39:09 -07:00
migrate.c	[PATCH] Fix sys_move_pages when a NULL node list is passed	2006-11-03 12:27:59 -08:00
mincore.c	…
mlock.c	…
mmap.c	Fix VM_MAYEXEC calculation	2006-10-15 14:09:55 -07:00
mmzone.c	[PATCH] mm/mmzone.c: EXPORT_UNUSED_SYMBOL	2006-07-10 13:24:17 -07:00
mprotect.c	[PATCH] paravirt: lazy mmu mode hooks.patch	2006-10-01 00:39:33 -07:00
mremap.c	[PATCH] paravirt: lazy mmu mode hooks.patch	2006-10-01 00:39:33 -07:00
msync.c	[PATCH] mm: msync() cleanup	2006-09-26 08:48:45 -07:00
nommu.c	Spelling fix: "control" instead of "cotrol"	2006-10-03 23:21:02 +02:00
oom_kill.c	[PATCH] OOM killer meets userspace headers	2006-10-20 10:26:38 -07:00
page-writeback.c	[PATCH] separate bdi congestion functions from queue congestion functions	2006-10-20 10:26:35 -07:00
page_alloc.c	[PATCH] mm: un-needed add-store operation wastes a few bytes	2006-11-03 12:27:56 -08:00
page_io.c	[PATCH] swsusp: read speedup	2006-09-26 08:48:58 -07:00
pdflush.c	[PATCH] pdflush: handle resume wakeups	2006-06-25 10:01:06 -07:00
prio_tree.c	…
readahead.c	[PATCH] Cleanup read_pages()	2006-11-03 12:27:56 -08:00
rmap.c	[PATCH] mm: more commenting on lock ordering	2006-10-20 10:26:44 -07:00
shmem.c	[PATCH] separate bdi congestion functions from queue congestion functions	2006-10-20 10:26:35 -07:00
shmem_acl.c	[PATCH] Fix typos in mm/shmem_acl.c	2006-10-11 11:14:23 -07:00
slab.c	[PATCH] init_reap_node() initialization fix	2006-11-03 12:27:58 -08:00
slob.c	[PATCH] Make kmem_cache_destroy() return void	2006-09-27 08:26:11 -07:00
sparse.c	[PATCH] memory hotplug: __GFP_NOWARN is better for __kmalloc_section_memmap()	2006-10-28 11:30:52 -07:00
swap.c	[PATCH] mm/: make functions static	2006-09-26 08:48:45 -07:00
swap_state.c	[PATCH] lockdep: locking init debugging improvement	2006-07-03 15:27:02 -07:00
swapfile.c	[PATCH] valid_swaphandles() fix	2006-09-29 09:18:23 -07:00
thrash.c	…
tiny-shmem.c	[PATCH] devfs: Remove the devfs_fs_kernel.h file from the tree	2006-06-26 12:25:08 -07:00
truncate.c	[PATCH] invalidate: remove_mapping() fix	2006-10-17 08:18:43 -07:00
util.c	[PATCH] slab: clean up leak tracking ifdefs a little bit	2006-10-04 07:55:13 -07:00
vmalloc.c	[PATCH] Fix GFP_HIGHMEM slab panic	2006-10-29 08:01:58 -08:00
vmscan.c	[PATCH] Use min of two prio settings in calculating distress for reclaim	2006-10-28 11:30:51 -07:00
vmstat.c	[PATCH] vmscan: Fix temp_priority race	2006-10-28 11:30:50 -07:00