Re: Usage of get_user_pages() in fs/aio.c

[Benjamin LaHaise <bcrl@redhat.com>]

On Wed, Nov 06, 2002 at 09:15:38PM +0100, Ingo Oeser wrote:
> What this can cause is clear ;-)
> 
> Simple fix would be to replace "info->mmap_size" with "nr_pages",
> that you compute just some lines above.

Whoops.  Yeah, that's a bug.  It hasn't actually been noticed in 
testing because the array of pages is freshly allocated from mmap 
and thus stops filling the array at nr_pages, but it could be 
exploited by a hostile user.  I'll feed that patch up asap.

		-ben
-- 
"Do you seek knowledge in time travel?"
--
To unsubscribe, send a message with 'unsubscribe linux-mm' in
the body to majordomo@kvack.org.  For more info on Linux MM,
see: http://www.linux-mm.org/