Commit aa9f7d51 authored Apr 01, 2020 by Randy Dunlap Committed by Linus Torvalds Apr 02, 2020

mm: mempolicy: require at least one nodeid for MPOL_PREFERRED



Using an empty (malformed) nodelist that is not caught during mount option
parsing leads to a stack-out-of-bounds access.

The option string that was used was: "mpol=prefer:,".  However,
MPOL_PREFERRED requires a single node number, which is not being provided
here.

Add a check that 'nodes' is not empty after parsing for MPOL_PREFERRED's
nodeid.

Fixes: 095f1fc4 ("mempolicy: rework shmem mpol parsing and display")
Reported-by: Entropy Moe <3ntr0py1337@gmail.com>
Reported-by:  <syzbot+b055b1a6b2b958707a21@syzkaller.appspotmail.com>
Signed-off-by: Randy Dunlap <rdunlap@infradead.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Tested-by:  <syzbot+b055b1a6b2b958707a21@syzkaller.appspotmail.com>
Cc: Lee Schermerhorn <lee.schermerhorn@hp.com>
Link: http://lkml.kernel.org/r/89526377-7eb6-b662-e1d8-4430928abde9@infradead.org


Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

parent d888fb2b

mm/mempolicy.c

+5 −1

Original line number	Diff line number	Diff line
		@@ -2898,7 +2898,9 @@ int mpol_parse_str(char str, struct mempolicy *mpol)
		switch (mode) {
		case MPOL_PREFERRED:
		/*
		* Insist on a nodelist of one node only
		* Insist on a nodelist of one node only, although later
		* we use first_node(nodes) to grab a single node, so here
		* nodelist (or nodes) cannot be empty.
		*/
		if (nodelist) {
		char *rest = nodelist;
		@@ -2906,6 +2908,8 @@ int mpol_parse_str(char str, struct mempolicy *mpol)
		rest++;
		if (*rest)
		goto out;
		if (nodes_empty(nodes))
		goto out;
		}
		break;
		case MPOL_INTERLEAVE:

Admin message