William Lee Irwin III cafdd8ba08 [PATCH] try_to_unmap_cluster() passes out-of-bounds pte to pte_unmap() ... try_to_unmap_cluster() does: for (pte = pte_offset_map(pmd, address); address < end; pte++, address += PAGE_SIZE) { ... } pte_unmap(pte); It may take a little staring to notice, but pte can actually fall off the end of the pte page in this iteration, which makes life difficult for kmap_atomic() and the users not expecting it to BUG(). Of course, we're somewhat lucky in that arithmetic elsewhere in the function guarantees that at least one iteration is made, lest this force larger rearrangements to be made. This issue and patch also apply to non-mm mainline and with trivial adjustments, at least two related kernels. Discovered during internal testing at Oracle. Signed-off-by: William Irwin <wli@holomorphy.com> Signed-off-by: Andrew Morton <akpm@osdl.org> Signed-off-by: Linus Torvalds <torvalds@osdl.org>		2005-05-24 20:08:13 -07:00
..
bootmem.c
fadvise.c
filemap.c	[PATCH] fix for __generic_file_aio_read() to return 0 on EOF	2005-05-21 16:45:24 -07:00
fremap.c
highmem.c	[PATCH] count bounce buffer pages in vmstat	2005-05-01 08:58:37 -07:00
hugetlb.c
internal.h
madvise.c
Makefile
memory.c	[PATCH] do_swap_page() can map random data if swap read fails	2005-05-17 07:59:20 -07:00
mempolicy.c	[PATCH] mempolicy.c GFP fix	2005-04-24 12:28:34 -07:00
mempool.c	[PATCH] use smp_mb/wmb/rmb where possible	2005-05-01 08:58:47 -07:00
mincore.c	[PATCH] freepgt: sys_mincore ignore FIRST_USER_PGD_NR	2005-04-19 13:29:20 -07:00
mlock.c
mmap.c	Fix get_unmapped_area sanity tests	2005-05-19 22:43:37 -07:00
mprotect.c
mremap.c	[PATCH] mm acct accounting fix	2005-05-17 07:59:12 -07:00
msync.c
nommu.c	[PATCH] mm/nommu.c: try to fix __vmalloc	2005-05-17 07:59:17 -07:00
oom_kill.c	[PATCH] oom-killer disable for iscsi/lvm2/multipath userland critical sections	2005-04-16 15:24:05 -07:00
page_alloc.c	[IA64] Export node_online_map and node_possible_map	2005-05-03 12:09:32 -07:00
page_io.c
page-writeback.c	[PATCH] DocBook: fix some descriptions	2005-05-01 08:59:26 -07:00
pdflush.c
prio_tree.c
readahead.c
rmap.c	[PATCH] try_to_unmap_cluster() passes out-of-bounds pte to pte_unmap()	2005-05-24 20:08:13 -07:00
shmem.c
slab.c	[PATCH] Change synchronize_kernel to _rcu and _sched	2005-05-01 08:59:04 -07:00
swap_state.c	[PATCH] mm: use __GFP_NOMEMALLOC	2005-05-01 08:58:37 -07:00
swap.c
swapfile.c	[PATCH] swapout oops fix	2005-05-17 07:59:18 -07:00
thrash.c
tiny-shmem.c
truncate.c	[PATCH] DocBook: fix some descriptions	2005-05-01 08:59:26 -07:00
vmalloc.c	[PATCH] x86_64: Fixed guard page handling again in iounmap	2005-05-20 15:48:20 -07:00
vmscan.c	[PATCH] vmscan: pageout(): remove unneeded test	2005-04-16 15:24:06 -07:00