oss-security - CVE request - kernel: nfsd: fix vm overcommit crash

Follow @Openwall on Twitter for new release announcements and other news

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <4BFC90AE.2090504@kernel.sg>
Date: Wed, 26 May 2010 11:08:30 +0800
From: Eugene Teo <eugeneteo@...nel.sg>
To: oss-security@...ts.openwall.com
CC: "Steven M. Christey" <coley@...us.mitre.org>
Subject: CVE request - kernel: nfsd: fix vm overcommit crash

"knfsd crashes if you are using it to export shmemfs objects and run 
strict overcommit. In this situation the current->mm based modifier to 
the overcommit goes through a NULL pointer.

We could simply check for NULL and skip the modifier but we've caught 
other real bugs in the past from mm being NULL here - cases where we did 
need a valid mm set up (eg the exec bug in 2005).

To preserve the checks and get the logic we want shuffle the checking 
around and add a new helper to the vm_ security wrappers

Also fix a current->mm reference in nommu that should use the passed mm"

Upstream commit:
nfsd: fix vm overcommit crash
http://git.kernel.org/linus/731572d39fcd3498702eda4600db4c43d51e0b26

Reference:
[PATCH] knfsd: add nfs-export support to tmpfs
http://git.kernel.org/linus/91828a405ae454a9503c41a7744f6ff877a80714
https://bugzilla.redhat.com/show_bug.cgi?id=595970

Backtrace (-rt kernel):
https://bugzilla.redhat.com/show_bug.cgi?id=595970#c1

Thanks, Eugene
-- 
main(i) { putchar(182623909 >> (i-1) * 5&31|!!(i<7)<<6) && main(++i); }

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.