Re: [memdup_user_nul] kernel BUG at mm/slab.c:2735!

From	Al Viro <viro@ZenIV.linux.org.uk>
Newsgroups	linux.kernel
Subject	Re: [memdup_user_nul] kernel BUG at mm/slab.c:2735!
Date	2015-12-29 16:00 +0100
Message-ID	<qL3UK-1Sp-13@gated-at.bofh.it> (permalink)
References	<qKw3t-3Io-929@gated-at.bofh.it> <qL1Jg-xv-3@gated-at.bofh.it> <qL3Bo-1LE-17@gated-at.bofh.it>
Organization	linux.* mail to news gateway

Show all headers | View raw

On Tue, Dec 29, 2015 at 02:39:47PM +0000, Al Viro wrote:
> On Tue, Dec 29, 2015 at 08:38:43PM +0800, Fengguang Wu wrote:
> > Hi Al,
> > 
> > It looks this patch has various impacts. Here are some more bug messages.
> > 
> > https://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs.git work.misc
> > 
> > commit c7af9d5728bed29ef614324e67e066896d087c8f
> 
> The version in vfs.git has been ad8e00e50cbda2ce3831a4badc239ad014eec69 for
> a couple of days already...

FWIW, the difference (and the source of those bugs) is that the earlier
variant had missed the fact that value of kbuf gets modified between the
allocation and freeing, so it ended up doing kfree() on the tail of kmalloced
buffer.
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

Back to linux.kernel | Previous | Next — Previous in thread | Find similar | Unroll thread

Thread

[memdup_user_nul] kernel BUG at mm/slab.c:2735! Fengguang Wu <fengguang.wu@intel.com> - 2015-12-29 13:40 +0100
  Re: [memdup_user_nul] kernel BUG at mm/slab.c:2735! Al Viro <viro@ZenIV.linux.org.uk> - 2015-12-29 15:40 +0100
    Re: [memdup_user_nul] kernel BUG at mm/slab.c:2735! Al Viro <viro@ZenIV.linux.org.uk> - 2015-12-29 16:00 +0100

csiph-web