| Message ID | 20170822190137.GA14164@p100.box (mailing list archive) |
|---|---|
| State | Superseded |
| Headers | show |
diff --git a/fs/select.c b/fs/select.c index 9d5f15e..c6362e3 100644 --- a/fs/select.c +++ b/fs/select.c @@ -1164,11 +1164,7 @@ int compat_get_fd_set(unsigned long nr, compat_ulong_t __user *ufdset, if (ufdset) { return compat_get_bitmap(fdset, ufdset, nr); } else { - /* Tricky, must clear full unsigned long in the - * kernel fdset at the end, ALIGN makes sure that - * actually happens. - */ - memset(fdset, 0, ALIGN(nr, BITS_PER_LONG)); + zero_fd_set(nr, fdset); return 0; } }
Dave, can you test this patch? Helge ------ [PATCH] Fix kernel panic due to memory corruption in compat_get_fd_set() Dave faced this kernel crash in the select() compat syscall on the parisc architecture: Kernel Fault: Code=26 (Data memory access rights trap) regs=00000002234b84e0 (Addr=0000000000000000) CPU: 1 PID: 21167 Comm: polyimport Not tainted 4.13.0-rc5+ #1 task: 0000000223d74b50 task.stack: 00000002234b8000 IAOQ[0]: memset+0x68/0xd8 IAOQ[1]: memset+0x6c/0xd8 RP(r2): compat_get_fd_set+0x5c/0x78 Backtrace: [<00000000402f316c>] compat_get_fd_set+0x5c/0x78 [<00000000402f3cac>] compat_core_sys_select+0x1cc/0x300 [<00000000402f52dc>] compat_SyS_select+0x144/0x1a0 [<0000000040155fe4>] syscall_exit+0x0/0x14 Kernel panic - not syncing: Kernel Fault It seems commit 464d62421cb8 ("select: switch compat_{get,put}_fd_set() to compat_{get,put}_bitmap()") broke the calculation on how many bytes need to be zeroed in case of fdset beeing NULL. This leads to memory overwrites and crashes. Fixes: 464d62421cb8 ("select: switch compat_{get,put}_fd_set() to compat_{get,put}_bitmap()" Cc: Al Viro <viro@zeniv.linux.org.uk> Cc: linux-fsdevel@vger.kernel.org Signed-off-by: Helge Deller <deller@gmx.de> -- To unsubscribe from this list: send the line "unsubscribe linux-parisc" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html