| From f83105d7ada1816fe7f453dbb9a630b309050cf7 Mon Sep 17 00:00:00 2001 |
| From: Dave Jones <davej@redhat.com> |
| Date: Thu, 6 Sep 2012 12:01:00 -0400 |
| Subject: [PATCH] Remove user-triggerable BUG from mpol_to_str |
| |
| commit 80de7c3138ee9fd86a98696fd2cf7ad89b995d0a upstream. |
| |
| Trivially triggerable, found by trinity: |
| |
| kernel BUG at mm/mempolicy.c:2546! |
| Process trinity-child2 (pid: 23988, threadinfo ffff88010197e000, task ffff88007821a670) |
| Call Trace: |
| show_numa_map+0xd5/0x450 |
| show_pid_numa_map+0x13/0x20 |
| traverse+0xf2/0x230 |
| seq_read+0x34b/0x3e0 |
| vfs_read+0xac/0x180 |
| sys_pread64+0xa2/0xc0 |
| system_call_fastpath+0x1a/0x1f |
| RIP: mpol_to_str+0x156/0x360 |
| |
| Signed-off-by: Dave Jones <davej@redhat.com> |
| Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org> |
| Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com> |
| --- |
| mm/mempolicy.c | 2 +- |
| 1 file changed, 1 insertion(+), 1 deletion(-) |
| |
| diff --git a/mm/mempolicy.c b/mm/mempolicy.c |
| index ae43da3aff5a..1d5c89a7e128 100644 |
| --- a/mm/mempolicy.c |
| +++ b/mm/mempolicy.c |
| @@ -2330,7 +2330,7 @@ int mpol_to_str(char *buffer, int maxlen, struct mempolicy *pol, int no_context) |
| break; |
| |
| default: |
| - BUG(); |
| + return -EINVAL; |
| } |
| |
| l = strlen(policy_types[mode]); |
| -- |
| 1.8.5.2 |
| |
