Skip to content

Commit aa9f7d5

Browse files
rddunlaptorvalds
authored andcommitted
mm: mempolicy: require at least one nodeid for MPOL_PREFERRED
Using an empty (malformed) nodelist that is not caught during mount option parsing leads to a stack-out-of-bounds access. The option string that was used was: "mpol=prefer:,". However, MPOL_PREFERRED requires a single node number, which is not being provided here. Add a check that 'nodes' is not empty after parsing for MPOL_PREFERRED's nodeid. Fixes: 095f1fc ("mempolicy: rework shmem mpol parsing and display") Reported-by: Entropy Moe <3ntr0py1337@gmail.com> Reported-by: syzbot+b055b1a6b2b958707a21@syzkaller.appspotmail.com Signed-off-by: Randy Dunlap <rdunlap@infradead.org> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Tested-by: syzbot+b055b1a6b2b958707a21@syzkaller.appspotmail.com Cc: Lee Schermerhorn <lee.schermerhorn@hp.com> Link: http://lkml.kernel.org/r/89526377-7eb6-b662-e1d8-4430928abde9@infradead.org Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
1 parent d888fb2 commit aa9f7d5

File tree

1 file changed

+5
-1
lines changed

1 file changed

+5
-1
lines changed

Diff for: mm/mempolicy.c

+5-1
Original file line numberDiff line numberDiff line change
@@ -2898,14 +2898,18 @@ int mpol_parse_str(char *str, struct mempolicy **mpol)
28982898
switch (mode) {
28992899
case MPOL_PREFERRED:
29002900
/*
2901-
* Insist on a nodelist of one node only
2901+
* Insist on a nodelist of one node only, although later
2902+
* we use first_node(nodes) to grab a single node, so here
2903+
* nodelist (or nodes) cannot be empty.
29022904
*/
29032905
if (nodelist) {
29042906
char *rest = nodelist;
29052907
while (isdigit(*rest))
29062908
rest++;
29072909
if (*rest)
29082910
goto out;
2911+
if (nodes_empty(nodes))
2912+
goto out;
29092913
}
29102914
break;
29112915
case MPOL_INTERLEAVE:

0 commit comments

Comments
 (0)