Skip to main content

Browse the archive

Revision 89a8640279f8bb78aaf778d1fc5c4a6778f18064 authored by David Howells on 30 October 2009, 13:13:26 UTC, committed by Linus Torvalds on 31 October 2009, 19:11:37 UTC 
NOMMU: Don't pass NULL pointers to fput() in do_mmap_pgoff()
 
Don't pass NULL pointers to fput() in the error handling paths of the NOMMU
do_mmap_pgoff() as it can't handle it.

The following can be used as a test program:

	int main() { static long long a[1024 * 1024 * 20] = { 0 }; return a;}

Without the patch, the code oopses in atomic_long_dec_and_test() as called by
fput() after the kernel complains that it can't allocate that big a chunk of
memory.  With the patch, the kernel just complains about the allocation size
and then the program segfaults during execve() as execve() can't complete the
allocation of all the new ELF program segments.

Reported-by: Robin Getz <rgetz@blackfin.uclinux.org>
Signed-off-by: David Howells <dhowells@redhat.com>
Acked-by: Robin Getz <rgetz@blackfin.uclinux.org>
Cc: stable@kernel.org
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
1 parent 2e2ec95
Raw File
af_rxrpc.h 
/* RxRPC kernel service interface definitions
 *
 * Copyright (C) 2007 Red Hat, Inc. All Rights Reserved.
 * Written by David Howells (dhowells@redhat.com)
 *
 * This program is free software; you can redistribute it and/or
 * modify it under the terms of the GNU General Public License
 * as published by the Free Software Foundation; either version
 * 2 of the License, or (at your option) any later version.
 */

#ifndef _NET_RXRPC_H
#define _NET_RXRPC_H

#ifdef __KERNEL__

#include <linux/rxrpc.h>

struct rxrpc_call;

/*
 * the mark applied to socket buffers that may be intercepted
 */
enum {
	RXRPC_SKB_MARK_DATA,		/* data message */
	RXRPC_SKB_MARK_FINAL_ACK,	/* final ACK received message */
	RXRPC_SKB_MARK_BUSY,		/* server busy message */
	RXRPC_SKB_MARK_REMOTE_ABORT,	/* remote abort message */
	RXRPC_SKB_MARK_NET_ERROR,	/* network error message */
	RXRPC_SKB_MARK_LOCAL_ERROR,	/* local error message */
	RXRPC_SKB_MARK_NEW_CALL,	/* local error message */
};

typedef void (*rxrpc_interceptor_t)(struct sock *, unsigned long,
				    struct sk_buff *);
extern void rxrpc_kernel_intercept_rx_messages(struct socket *,
					       rxrpc_interceptor_t);
extern struct rxrpc_call *rxrpc_kernel_begin_call(struct socket *,
						  struct sockaddr_rxrpc *,
						  struct key *,
						  unsigned long,
						  gfp_t);
extern int rxrpc_kernel_send_data(struct rxrpc_call *, struct msghdr *,
				  size_t);
extern void rxrpc_kernel_abort_call(struct rxrpc_call *, u32);
extern void rxrpc_kernel_end_call(struct rxrpc_call *);
extern bool rxrpc_kernel_is_data_last(struct sk_buff *);
extern u32 rxrpc_kernel_get_abort_code(struct sk_buff *);
extern int rxrpc_kernel_get_error_number(struct sk_buff *);
extern void rxrpc_kernel_data_delivered(struct sk_buff *);
extern void rxrpc_kernel_free_skb(struct sk_buff *);
extern struct rxrpc_call *rxrpc_kernel_accept_call(struct socket *,
						   unsigned long);
extern int rxrpc_kernel_reject_call(struct socket *);

#endif /* __KERNEL__ */
#endif /* _NET_RXRPC_H */
back to top