Revision 89a8640279f8bb78aaf778d1fc5c4a6778f18064 authored by David Howells on 30 October 2009, 13:13:26 UTC, committed by Linus Torvalds on 31 October 2009, 19:11:37 UTC
Don't pass NULL pointers to fput() in the error handling paths of the NOMMU
do_mmap_pgoff() as it can't handle it.
The following can be used as a test program:
int main() { static long long a[1024 * 1024 * 20] = { 0 }; return a;}
Without the patch, the code oopses in atomic_long_dec_and_test() as called by
fput() after the kernel complains that it can't allocate that big a chunk of
memory. With the patch, the kernel just complains about the allocation size
and then the program segfaults during execve() as execve() can't complete the
allocation of all the new ELF program segments.
Reported-by: Robin Getz <rgetz@blackfin.uclinux.org>
Signed-off-by: David Howells <dhowells@redhat.com>
Acked-by: Robin Getz <rgetz@blackfin.uclinux.org>
Cc: stable@kernel.org
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
1 parent 2e2ec95
| File | Mode | Size |
|---|---|---|
| bitops | ||
| 4level-fixup.h | -rw-r--r-- | 1.0 KB |
| Kbuild | -rw-r--r-- | 743 bytes |
| Kbuild.asm | -rw-r--r-- | 1.1 KB |
| atomic-long.h | -rw-r--r-- | 5.1 KB |
| atomic.h | -rw-r--r-- | 4.0 KB |
| atomic64.h | -rw-r--r-- | 1.8 KB |
| audit_change_attr.h | -rw-r--r-- | 320 bytes |
| audit_dir_write.h | -rw-r--r-- | 238 bytes |
| audit_read.h | -rw-r--r-- | 127 bytes |
| audit_signal.h | -rw-r--r-- | 36 bytes |
| audit_write.h | -rw-r--r-- | 255 bytes |
| auxvec.h | -rw-r--r-- | 218 bytes |
| bitops.h | -rw-r--r-- | 1.3 KB |
| bitsperlong.h | -rw-r--r-- | 874 bytes |
| bug.h | -rw-r--r-- | 3.6 KB |
| bugs.h | -rw-r--r-- | 228 bytes |
| cache.h | -rw-r--r-- | 345 bytes |
| cacheflush.h | -rw-r--r-- | 1.2 KB |
| checksum.h | -rw-r--r-- | 2.1 KB |
| cmpxchg-local.h | -rw-r--r-- | 1.3 KB |
| cmpxchg.h | -rw-r--r-- | 537 bytes |
| cputime.h | -rw-r--r-- | 2.0 KB |
| current.h | -rw-r--r-- | 217 bytes |
| delay.h | -rw-r--r-- | 213 bytes |
| device.h | -rw-r--r-- | 245 bytes |
| div64.h | -rw-r--r-- | 1.3 KB |
| dma-coherent.h | -rw-r--r-- | 891 bytes |
| dma-mapping-broken.h | -rw-r--r-- | 2.4 KB |
| dma-mapping-common.h | -rw-r--r-- | 5.4 KB |
| dma.h | -rw-r--r-- | 514 bytes |
| emergency-restart.h | -rw-r--r-- | 209 bytes |
| errno-base.h | -rw-r--r-- | 1.5 KB |
| errno.h | -rw-r--r-- | 5.1 KB |
| fb.h | -rw-r--r-- | 232 bytes |
| fcntl.h | -rw-r--r-- | 3.5 KB |
| futex.h | -rw-r--r-- | 1.2 KB |
| getorder.h | -rw-r--r-- | 421 bytes |
| gpio.h | -rw-r--r-- | 6.1 KB |
| hardirq.h | -rw-r--r-- | 493 bytes |
| hw_irq.h | -rw-r--r-- | 270 bytes |
| ide_iops.h | -rw-r--r-- | 752 bytes |
| int-l64.h | -rw-r--r-- | 1.3 KB |
| int-ll64.h | -rw-r--r-- | 1.4 KB |
| io.h | -rw-r--r-- | 7.0 KB |
| ioctl.h | -rw-r--r-- | 3.4 KB |
| ioctls.h | -rw-r--r-- | 3.3 KB |
| iomap.h | -rw-r--r-- | 2.7 KB |
| ipcbuf.h | -rw-r--r-- | 936 bytes |
| irq.h | -rw-r--r-- | 364 bytes |
| irq_regs.h | -rw-r--r-- | 980 bytes |
| irqflags.h | -rw-r--r-- | 1.6 KB |
| kdebug.h | -rw-r--r-- | 140 bytes |
| kmap_types.h | -rw-r--r-- | 736 bytes |
| libata-portmap.h | -rw-r--r-- | 153 bytes |
| linkage.h | -rw-r--r-- | 225 bytes |
| local.h | -rw-r--r-- | 3.1 KB |
| memory_model.h | -rw-r--r-- | 1.9 KB |
| mm_hooks.h | -rw-r--r-- | 425 bytes |
| mman-common.h | -rw-r--r-- | 1.8 KB |
| mman.h | -rw-r--r-- | 799 bytes |
| mmu.h | -rw-r--r-- | 329 bytes |
| mmu_context.h | -rw-r--r-- | 842 bytes |
| module.h | -rw-r--r-- | 421 bytes |
| msgbuf.h | -rw-r--r-- | 1.5 KB |
| mutex-dec.h | -rw-r--r-- | 2.9 KB |
| mutex-null.h | -rw-r--r-- | 666 bytes |
| mutex-xchg.h | -rw-r--r-- | 3.7 KB |
| mutex.h | -rw-r--r-- | 256 bytes |
| page.h | -rw-r--r-- | 2.4 KB |
| param.h | -rw-r--r-- | 499 bytes |
| parport.h | -rw-r--r-- | 585 bytes |
| pci-dma-compat.h | -rw-r--r-- | 3.3 KB |
| pci.h | -rw-r--r-- | 1.4 KB |
| percpu.h | -rw-r--r-- | 2.6 KB |
| pgalloc.h | -rw-r--r-- | 303 bytes |
| pgtable-nopmd.h | -rw-r--r-- | 1.9 KB |
| pgtable-nopud.h | -rw-r--r-- | 1.8 KB |
| pgtable.h | -rw-r--r-- | 10.4 KB |
| poll.h | -rw-r--r-- | 708 bytes |
| posix_types.h | -rw-r--r-- | 3.6 KB |
| resource.h | -rw-r--r-- | 2.8 KB |
| rtc.h | -rw-r--r-- | 5.3 KB |
| scatterlist.h | -rw-r--r-- | 1.1 KB |
| sections.h | -rw-r--r-- | 1.1 KB |
| segment.h | -rw-r--r-- | 249 bytes |
| sembuf.h | -rw-r--r-- | 1.2 KB |
| serial.h | -rw-r--r-- | 306 bytes |
| setup.h | -rw-r--r-- | 127 bytes |
| shmbuf.h | -rw-r--r-- | 1.7 KB |
| shmparam.h | -rw-r--r-- | 168 bytes |
| siginfo.h | -rw-r--r-- | 8.7 KB |
| signal-defs.h | -rw-r--r-- | 802 bytes |
| signal.h | -rw-r--r-- | 2.8 KB |
| socket.h | -rw-r--r-- | 1.4 KB |
| sockios.h | -rw-r--r-- | 376 bytes |
| spinlock.h | -rw-r--r-- | 290 bytes |
| stat.h | -rw-r--r-- | 2.5 KB |
| statfs.h | -rw-r--r-- | 1.7 KB |
| string.h | -rw-r--r-- | 281 bytes |
| swab.h | -rw-r--r-- | 439 bytes |
| syscall.h | -rw-r--r-- | 5.7 KB |
| syscalls.h | -rw-r--r-- | 1.6 KB |
| system.h | -rw-r--r-- | 3.7 KB |
| termbits.h | -rw-r--r-- | 4.5 KB |
| termios-base.h | -rw-r--r-- | 2.1 KB |
| termios.h | -rw-r--r-- | 4.0 KB |
| timex.h | -rw-r--r-- | 469 bytes |
| tlb.h | -rw-r--r-- | 3.8 KB |
| tlbflush.h | -rw-r--r-- | 422 bytes |
| topology.h | -rw-r--r-- | 1.7 KB |
| types.h | -rw-r--r-- | 1.0 KB |
| uaccess-unaligned.h | -rw-r--r-- | 733 bytes |
| uaccess.h | -rw-r--r-- | 7.2 KB |
| ucontext.h | -rw-r--r-- | 294 bytes |
| unaligned.h | -rw-r--r-- | 907 bytes |
| unistd.h | -rw-r--r-- | 24.8 KB |
| user.h | -rw-r--r-- | 241 bytes |
| vga.h | -rw-r--r-- | 548 bytes |
| vmlinux.lds.h | -rw-r--r-- | 21.9 KB |
| xor.h | -rw-r--r-- | 13.6 KB |
Computing file changes ...
