Re: [BUGFIX] NULL pointer dereference in __vm_enough_memory()

Re: [BUGFIX] NULL pointer dereference in __vm_enough_memory()

[WU Fengguang]

Hi Balbir,

[add CC to LKML]

On Sun, Aug 12, 2007 at 05:27:52PM +0530, Balbir Singh wrote:
> For some reason my mailer keeps removing you from the cc.

Or maybe it's my SMTP server's problem. Email systems are complex.

> >>> Thats a valid point. It would be interesting to see what the overcommit
> >>> setting was, when the panic occurred.
> >> FYI, I do have nondefault overcommit settings:
> >>
> >> vm.overcommit_memory = 2
> >> vm.lowmem_reserve_ratio = 1 1
> > 
> > Yes, the bug disappears when changing to default overcommit_memory!
> > 
> 
> Great! So the problem might have existed for some time, but we never
> saw it due to default over commit values? Were you using these values
> for over commit even before?

No I changed it several weeks ago to stop my desktop from freezing.
So yes, the bug may have been there for a while.

Re: [BUGFIX] NULL pointer dereference in __vm_enough_memory()

[Alan Cox]

> > Great! So the problem might have existed for some time, but we never
> > saw it due to default over commit values? Were you using these values
> > for over commit even before?
> 
> No I changed it several weeks ago to stop my desktop from freezing.
> So yes, the bug may have been there for a while.

The bug is the new exec with lots of arguments code. It tries to insert a
vm struct without having a valid current->mm. That isn't permitted and
never had been (which is also why it broke the sparc mmu code etc).

You'll need to change the kernel security interface a little to make this
fly - I think the following should do it.

	- make __vm_enough_memory take a struct mm pointer and use it
	- make security_ops pass the extra current->mm
	- add a vm_enough_memory_mm security op
	- use security_vm_enough_memory_mm(mm, ...) in __insert_vm_struct

I'll knock up a quick patch and see what is needed (someone else can do
the selinux changes)

Re: [BUGFIX] NULL pointer dereference in __vm_enough_memory()

[WU Fengguang]

On Sun, Aug 12, 2007 at 02:19:05PM +0100, Alan Cox wrote:
> > > Great! So the problem might have existed for some time, but we never
> > > saw it due to default over commit values? Were you using these values
> > > for over commit even before?
> > 
> > No I changed it several weeks ago to stop my desktop from freezing.
> > So yes, the bug may have been there for a while.
> 
> The bug is the new exec with lots of arguments code. It tries to insert a
> vm struct without having a valid current->mm. That isn't permitted and
> never had been (which is also why it broke the sparc mmu code etc).
> 
> You'll need to change the kernel security interface a little to make this
> fly - I think the following should do it.
> 
> 	- make __vm_enough_memory take a struct mm pointer and use it
> 	- make security_ops pass the extra current->mm
> 	- add a vm_enough_memory_mm security op
> 	- use security_vm_enough_memory_mm(mm, ...) in __insert_vm_struct
> 
> I'll knock up a quick patch and see what is needed (someone else can do
> the selinux changes)

Thank you!

Count me for one - but CC SELinux maintainers first :)

Re: [BUGFIX] NULL pointer dereference in __vm_enough_memory()

[Alan Cox]

Try this (it compiles but isnt tested). Its a weekend here, the sun is
shining, the beach is a short walk, and I have more interesting things to
do right now 8)


diff -u --new-file --recursive --exclude-from /usr/src/exclude linux.vanilla-2.6.23rc1-mm1/include/linux/mm.h linux-2.6.23rc1-mm1/include/linux/mm.h
--- linux.vanilla-2.6.23rc1-mm1/include/linux/mm.h	2007-07-26 15:02:58.000000000 +0100
+++ linux-2.6.23rc1-mm1/include/linux/mm.h	2007-08-12 13:54:24.614647536 +0100
@@ -1079,7 +1079,7 @@
 }
 
 /* mmap.c */
-extern int __vm_enough_memory(long pages, int cap_sys_admin);
+extern int __vm_enough_memory(struct mm_struct *mm, long pages, int cap_sys_admin);
 extern void vma_adjust(struct vm_area_struct *vma, unsigned long start,
 	unsigned long end, pgoff_t pgoff, struct vm_area_struct *insert);
 extern struct vm_area_struct *vma_merge(struct mm_struct *,
diff -u --new-file --recursive --exclude-from /usr/src/exclude linux.vanilla-2.6.23rc1-mm1/include/linux/security.h linux-2.6.23rc1-mm1/include/linux/security.h
--- linux.vanilla-2.6.23rc1-mm1/include/linux/security.h	2007-07-26 15:02:58.000000000 +0100
+++ linux-2.6.23rc1-mm1/include/linux/security.h	2007-08-12 14:13:10.383504656 +0100
@@ -58,7 +58,7 @@
 extern int cap_task_setioprio (struct task_struct *p, int ioprio);
 extern int cap_task_setnice (struct task_struct *p, int nice);
 extern int cap_syslog (int type);
-extern int cap_vm_enough_memory (long pages);
+extern int cap_vm_enough_memory (struct mm_struct *mm, long pages);
 
 struct msghdr;
 struct sk_buff;
@@ -1129,6 +1129,7 @@
  *	Return 0 if permission is granted.
  * @vm_enough_memory:
  *	Check permissions for allocating a new virtual mapping.
+ *	@mm contains the mm struct it is being added to.
  *      @pages contains the number of pages.
  *	Return 0 if permission is granted.
  *
@@ -1173,7 +1174,7 @@
 	int (*quota_on) (struct dentry * dentry);
 	int (*syslog) (int type);
 	int (*settime) (struct timespec *ts, struct timezone *tz);
-	int (*vm_enough_memory) (long pages);
+	int (*vm_enough_memory) (struct mm_struct *mm, long pages);
 
 	int (*bprm_alloc_security) (struct linux_binprm * bprm);
 	void (*bprm_free_security) (struct linux_binprm * bprm);
@@ -1439,6 +1440,7 @@
 int security_syslog(int type);
 int security_settime(struct timespec *ts, struct timezone *tz);
 int security_vm_enough_memory(long pages);
+int security_vm_enough_memory_mm(struct mm_struct *mm, long pages);
 int security_bprm_alloc(struct linux_binprm *bprm);
 void security_bprm_free(struct linux_binprm *bprm);
 void security_bprm_apply_creds(struct linux_binprm *bprm, int unsafe);
diff -u --new-file --recursive --exclude-from /usr/src/exclude linux.vanilla-2.6.23rc1-mm1/mm/mmap.c linux-2.6.23rc1-mm1/mm/mmap.c
--- linux.vanilla-2.6.23rc1-mm1/mm/mmap.c	2007-07-26 15:02:58.000000000 +0100
+++ linux-2.6.23rc1-mm1/mm/mmap.c	2007-08-12 13:53:22.000000000 +0100
@@ -93,7 +93,7 @@
  * Note this is a helper function intended to be used by LSMs which
  * wish to use this logic.
  */
-int __vm_enough_memory(long pages, int cap_sys_admin)
+int __vm_enough_memory(struct mm_struct *mm, long pages, int cap_sys_admin)
 {
 	unsigned long free, allowed;
 
@@ -166,7 +166,7 @@
 
 	/* Don't let a single process grow too big:
 	   leave 3% of the size of this process for other processes */
-	allowed -= current->mm->total_vm / 32;
+	allowed -= mm->total_vm / 32;
 
 	/*
 	 * cast `allowed' as a signed long because vm_committed_space
@@ -2058,7 +2058,7 @@
 	if (__vma && __vma->vm_start < vma->vm_end)
 		return -ENOMEM;
 	if ((vma->vm_flags & VM_ACCOUNT) &&
-	     security_vm_enough_memory(vma_pages(vma)))
+	     security_vm_enough_memory_mm(mm, vma_pages(vma)))
 		return -ENOMEM;
 	vma_link(mm, vma, prev, rb_link, rb_parent);
 	return 0;
diff -u --new-file --recursive --exclude-from /usr/src/exclude linux.vanilla-2.6.23rc1-mm1/mm/nommu.c linux-2.6.23rc1-mm1/mm/nommu.c
--- linux.vanilla-2.6.23rc1-mm1/mm/nommu.c	2007-07-26 15:02:08.000000000 +0100
+++ linux-2.6.23rc1-mm1/mm/nommu.c	2007-08-12 13:53:57.000000000 +0100
@@ -1270,7 +1270,7 @@
  * Note this is a helper function intended to be used by LSMs which
  * wish to use this logic.
  */
-int __vm_enough_memory(long pages, int cap_sys_admin)
+int __vm_enough_memory(struct mm_struct *mm, long pages, int cap_sys_admin)
 {
 	unsigned long free, allowed;
 
diff -u --new-file --recursive --exclude-from /usr/src/exclude linux.vanilla-2.6.23rc1-mm1/security/commoncap.c linux-2.6.23rc1-mm1/security/commoncap.c
--- linux.vanilla-2.6.23rc1-mm1/security/commoncap.c	2007-07-26 15:02:59.000000000 +0100
+++ linux-2.6.23rc1-mm1/security/commoncap.c	2007-08-12 14:13:29.000000000 +0100
@@ -489,13 +489,13 @@
 	return 0;
 }
 
-int cap_vm_enough_memory(long pages)
+int cap_vm_enough_memory(struct mm_struct *mm, long pages)
 {
 	int cap_sys_admin = 0;
 
 	if (cap_capable(current, CAP_SYS_ADMIN) == 0)
 		cap_sys_admin = 1;
-	return __vm_enough_memory(pages, cap_sys_admin);
+	return __vm_enough_memory(mm, pages, cap_sys_admin);
 }
 
 EXPORT_SYMBOL(cap_capable);
diff -u --new-file --recursive --exclude-from /usr/src/exclude linux.vanilla-2.6.23rc1-mm1/security/dummy.c linux-2.6.23rc1-mm1/security/dummy.c
--- linux.vanilla-2.6.23rc1-mm1/security/dummy.c	2007-07-26 15:02:59.000000000 +0100
+++ linux-2.6.23rc1-mm1/security/dummy.c	2007-08-12 14:10:49.000000000 +0100
@@ -107,13 +107,13 @@
 	return 0;
 }
 
-static int dummy_vm_enough_memory(long pages)
+static int dummy_vm_enough_memory(struct mm_struct *mm, long pages)
 {
 	int cap_sys_admin = 0;
 
 	if (dummy_capable(current, CAP_SYS_ADMIN) == 0)
 		cap_sys_admin = 1;
-	return __vm_enough_memory(pages, cap_sys_admin);
+	return __vm_enough_memory(mm, pages, cap_sys_admin);
 }
 
 static int dummy_bprm_alloc_security (struct linux_binprm *bprm)
diff -u --new-file --recursive --exclude-from /usr/src/exclude linux.vanilla-2.6.23rc1-mm1/security/security.c linux-2.6.23rc1-mm1/security/security.c
--- linux.vanilla-2.6.23rc1-mm1/security/security.c	2007-07-26 15:02:59.000000000 +0100
+++ linux-2.6.23rc1-mm1/security/security.c	2007-08-12 13:47:53.000000000 +0100
@@ -237,10 +237,14 @@
 	return security_ops->settime(ts, tz);
 }
 
-
 int security_vm_enough_memory(long pages)
 {
-	return security_ops->vm_enough_memory(pages);
+	return security_ops->vm_enough_memory(current->mm, pages);
+}
+
+int security_vm_enough_memory_mm(struct mm_struct *mm, long pages)
+{
+	return security_ops->vm_enough_memory(mm, pages);
 }
 
 int security_bprm_alloc(struct linux_binprm *bprm)
diff -u --new-file --recursive --exclude-from /usr/src/exclude linux.vanilla-2.6.23rc1-mm1/security/selinux/hooks.c linux-2.6.23rc1-mm1/security/selinux/hooks.c
--- linux.vanilla-2.6.23rc1-mm1/security/selinux/hooks.c	2007-07-26 15:02:59.000000000 +0100
+++ linux-2.6.23rc1-mm1/security/selinux/hooks.c	2007-08-12 14:11:21.000000000 +0100
@@ -1584,7 +1584,7 @@
  * Do not audit the selinux permission check, as this is applied to all
  * processes that allocate mappings.
  */
-static int selinux_vm_enough_memory(long pages)
+static int selinux_vm_enough_memory(struct mm_struct *mm, long pages)
 {
 	int rc, cap_sys_admin = 0;
 	struct task_security_struct *tsec = current->security;
@@ -1600,7 +1600,7 @@
 	if (rc == 0)
 		cap_sys_admin = 1;
 
-	return __vm_enough_memory(pages, cap_sys_admin);
+	return __vm_enough_memory(mm, pages, cap_sys_admin);
 }
 
 /* binprm security operations */

Re: [BUGFIX] NULL pointer dereference in __vm_enough_memory()

[Cyrill Gorcunov]

[Alan Cox - Sun, Aug 12, 2007 at 04:17:44PM +0100]
| Try this (it compiles but isnt tested). Its a weekend here, the sun is
| shining, the beach is a short walk, and I have more interesting things to
| do right now 8)
| 
| 
| diff -u --new-file --recursive --exclude-from /usr/src/exclude linux.vanilla-2.6.23rc1-mm1/include/linux/mm.h linux-2.6.23rc1-mm1/include/linux/mm.h
| --- linux.vanilla-2.6.23rc1-mm1/include/linux/mm.h	2007-07-26 15:02:58.000000000 +0100
| +++ linux-2.6.23rc1-mm1/include/linux/mm.h	2007-08-12 13:54:24.614647536 +0100
| @@ -1079,7 +1079,7 @@
|  }
|  
|  /* mmap.c */
| -extern int __vm_enough_memory(long pages, int cap_sys_admin);
| +extern int __vm_enough_memory(struct mm_struct *mm, long pages, int cap_sys_admin);
|  extern void vma_adjust(struct vm_area_struct *vma, unsigned long start,
|  	unsigned long end, pgoff_t pgoff, struct vm_area_struct *insert);
|  extern struct vm_area_struct *vma_merge(struct mm_struct *,
| diff -u --new-file --recursive --exclude-from /usr/src/exclude linux.vanilla-2.6.23rc1-mm1/include/linux/security.h linux-2.6.23rc1-mm1/include/linux/security.h
| --- linux.vanilla-2.6.23rc1-mm1/include/linux/security.h	2007-07-26 15:02:58.000000000 +0100
| +++ linux-2.6.23rc1-mm1/include/linux/security.h	2007-08-12 14:13:10.383504656 +0100
| @@ -58,7 +58,7 @@
|  extern int cap_task_setioprio (struct task_struct *p, int ioprio);
|  extern int cap_task_setnice (struct task_struct *p, int nice);
|  extern int cap_syslog (int type);
| -extern int cap_vm_enough_memory (long pages);
| +extern int cap_vm_enough_memory (struct mm_struct *mm, long pages);
|  
|  struct msghdr;
|  struct sk_buff;
| @@ -1129,6 +1129,7 @@
|   *	Return 0 if permission is granted.
|   * @vm_enough_memory:
|   *	Check permissions for allocating a new virtual mapping.
| + *	@mm contains the mm struct it is being added to.
|   *      @pages contains the number of pages.
|   *	Return 0 if permission is granted.
|   *
| @@ -1173,7 +1174,7 @@
|  	int (*quota_on) (struct dentry * dentry);
|  	int (*syslog) (int type);
|  	int (*settime) (struct timespec *ts, struct timezone *tz);
| -	int (*vm_enough_memory) (long pages);
| +	int (*vm_enough_memory) (struct mm_struct *mm, long pages);
|  
|  	int (*bprm_alloc_security) (struct linux_binprm * bprm);
|  	void (*bprm_free_security) (struct linux_binprm * bprm);
| @@ -1439,6 +1440,7 @@
|  int security_syslog(int type);
|  int security_settime(struct timespec *ts, struct timezone *tz);
|  int security_vm_enough_memory(long pages);
| +int security_vm_enough_memory_mm(struct mm_struct *mm, long pages);
|  int security_bprm_alloc(struct linux_binprm *bprm);
|  void security_bprm_free(struct linux_binprm *bprm);
|  void security_bprm_apply_creds(struct linux_binprm *bprm, int unsafe);
| diff -u --new-file --recursive --exclude-from /usr/src/exclude linux.vanilla-2.6.23rc1-mm1/mm/mmap.c linux-2.6.23rc1-mm1/mm/mmap.c
| --- linux.vanilla-2.6.23rc1-mm1/mm/mmap.c	2007-07-26 15:02:58.000000000 +0100
| +++ linux-2.6.23rc1-mm1/mm/mmap.c	2007-08-12 13:53:22.000000000 +0100
| @@ -93,7 +93,7 @@
|   * Note this is a helper function intended to be used by LSMs which
|   * wish to use this logic.
|   */
| -int __vm_enough_memory(long pages, int cap_sys_admin)
| +int __vm_enough_memory(struct mm_struct *mm, long pages, int cap_sys_admin)
|  {
|  	unsigned long free, allowed;
|  
| @@ -166,7 +166,7 @@
|  
|  	/* Don't let a single process grow too big:
|  	   leave 3% of the size of this process for other processes */
| -	allowed -= current->mm->total_vm / 32;
| +	allowed -= mm->total_vm / 32;

So mm->total_vm is 0 for __bprm_mm_init case. Is that ok? Or I miss
something?

|  
|  	/*
|  	 * cast `allowed' as a signed long because vm_committed_space
| @@ -2058,7 +2058,7 @@
|  	if (__vma && __vma->vm_start < vma->vm_end)
|  		return -ENOMEM;
|  	if ((vma->vm_flags & VM_ACCOUNT) &&
| -	     security_vm_enough_memory(vma_pages(vma)))
| +	     security_vm_enough_memory_mm(mm, vma_pages(vma)))
|  		return -ENOMEM;
|  	vma_link(mm, vma, prev, rb_link, rb_parent);
|  	return 0;
| diff -u --new-file --recursive --exclude-from /usr/src/exclude linux.vanilla-2.6.23rc1-mm1/mm/nommu.c linux-2.6.23rc1-mm1/mm/nommu.c
| --- linux.vanilla-2.6.23rc1-mm1/mm/nommu.c	2007-07-26 15:02:08.000000000 +0100
| +++ linux-2.6.23rc1-mm1/mm/nommu.c	2007-08-12 13:53:57.000000000 +0100
| @@ -1270,7 +1270,7 @@
|   * Note this is a helper function intended to be used by LSMs which
|   * wish to use this logic.
|   */
| -int __vm_enough_memory(long pages, int cap_sys_admin)
| +int __vm_enough_memory(struct mm_struct *mm, long pages, int cap_sys_admin)
|  {
|  	unsigned long free, allowed;
|  
| diff -u --new-file --recursive --exclude-from /usr/src/exclude linux.vanilla-2.6.23rc1-mm1/security/commoncap.c linux-2.6.23rc1-mm1/security/commoncap.c
| --- linux.vanilla-2.6.23rc1-mm1/security/commoncap.c	2007-07-26 15:02:59.000000000 +0100
| +++ linux-2.6.23rc1-mm1/security/commoncap.c	2007-08-12 14:13:29.000000000 +0100
| @@ -489,13 +489,13 @@
|  	return 0;
|  }
|  
| -int cap_vm_enough_memory(long pages)
| +int cap_vm_enough_memory(struct mm_struct *mm, long pages)
|  {
|  	int cap_sys_admin = 0;
|  
|  	if (cap_capable(current, CAP_SYS_ADMIN) == 0)
|  		cap_sys_admin = 1;
| -	return __vm_enough_memory(pages, cap_sys_admin);
| +	return __vm_enough_memory(mm, pages, cap_sys_admin);
|  }
|  
|  EXPORT_SYMBOL(cap_capable);
| diff -u --new-file --recursive --exclude-from /usr/src/exclude linux.vanilla-2.6.23rc1-mm1/security/dummy.c linux-2.6.23rc1-mm1/security/dummy.c
| --- linux.vanilla-2.6.23rc1-mm1/security/dummy.c	2007-07-26 15:02:59.000000000 +0100
| +++ linux-2.6.23rc1-mm1/security/dummy.c	2007-08-12 14:10:49.000000000 +0100
| @@ -107,13 +107,13 @@
|  	return 0;
|  }
|  
| -static int dummy_vm_enough_memory(long pages)
| +static int dummy_vm_enough_memory(struct mm_struct *mm, long pages)
|  {
|  	int cap_sys_admin = 0;
|  
|  	if (dummy_capable(current, CAP_SYS_ADMIN) == 0)
|  		cap_sys_admin = 1;
| -	return __vm_enough_memory(pages, cap_sys_admin);
| +	return __vm_enough_memory(mm, pages, cap_sys_admin);
|  }
|  
|  static int dummy_bprm_alloc_security (struct linux_binprm *bprm)
| diff -u --new-file --recursive --exclude-from /usr/src/exclude linux.vanilla-2.6.23rc1-mm1/security/security.c linux-2.6.23rc1-mm1/security/security.c
| --- linux.vanilla-2.6.23rc1-mm1/security/security.c	2007-07-26 15:02:59.000000000 +0100
| +++ linux-2.6.23rc1-mm1/security/security.c	2007-08-12 13:47:53.000000000 +0100
| @@ -237,10 +237,14 @@
|  	return security_ops->settime(ts, tz);
|  }
|  
| -
|  int security_vm_enough_memory(long pages)
|  {
| -	return security_ops->vm_enough_memory(pages);
| +	return security_ops->vm_enough_memory(current->mm, pages);
| +}
| +
| +int security_vm_enough_memory_mm(struct mm_struct *mm, long pages)
| +{
| +	return security_ops->vm_enough_memory(mm, pages);
|  }
|  
|  int security_bprm_alloc(struct linux_binprm *bprm)
| diff -u --new-file --recursive --exclude-from /usr/src/exclude linux.vanilla-2.6.23rc1-mm1/security/selinux/hooks.c linux-2.6.23rc1-mm1/security/selinux/hooks.c
| --- linux.vanilla-2.6.23rc1-mm1/security/selinux/hooks.c	2007-07-26 15:02:59.000000000 +0100
| +++ linux-2.6.23rc1-mm1/security/selinux/hooks.c	2007-08-12 14:11:21.000000000 +0100
| @@ -1584,7 +1584,7 @@
|   * Do not audit the selinux permission check, as this is applied to all
|   * processes that allocate mappings.
|   */
| -static int selinux_vm_enough_memory(long pages)
| +static int selinux_vm_enough_memory(struct mm_struct *mm, long pages)
|  {
|  	int rc, cap_sys_admin = 0;
|  	struct task_security_struct *tsec = current->security;
| @@ -1600,7 +1600,7 @@
|  	if (rc == 0)
|  		cap_sys_admin = 1;
|  
| -	return __vm_enough_memory(pages, cap_sys_admin);
| +	return __vm_enough_memory(mm, pages, cap_sys_admin);
|  }
|  
|  /* binprm security operations */

		Cyrill

Re: [BUGFIX] NULL pointer dereference in __vm_enough_memory()

[WU Fengguang]

On Sun, Aug 12, 2007 at 08:21:43PM +0400, Cyrill Gorcunov wrote:
> [Alan Cox - Sun, Aug 12, 2007 at 04:17:44PM +0100]
> | Try this (it compiles but isnt tested). Its a weekend here, the sun is
> | shining, the beach is a short walk, and I have more interesting things to
> | do right now 8)
> | 
> | 
[...]
> | -int __vm_enough_memory(long pages, int cap_sys_admin)
> | +int __vm_enough_memory(struct mm_struct *mm, long pages, int cap_sys_admin)
> |  {
> |  	unsigned long free, allowed;
> |  
> | @@ -166,7 +166,7 @@
> |  
> |  	/* Don't let a single process grow too big:
> |  	   leave 3% of the size of this process for other processes */
> | -	allowed -= current->mm->total_vm / 32;
> | +	allowed -= mm->total_vm / 32;
> 
> So mm->total_vm is 0 for __bprm_mm_init case. Is that ok? Or I miss
> something?

Yeah, Alan adds mm to the interfaces and leaves us the question of
"what mm to pass in when current->mm == NULL?" ;)

Re: [BUGFIX] NULL pointer dereference in __vm_enough_memory()

[Cyrill Gorcunov]

[WU Fengguang - Mon, Aug 13, 2007 at 08:23:42AM +0800]
| On Sun, Aug 12, 2007 at 08:21:43PM +0400, Cyrill Gorcunov wrote:
| > [Alan Cox - Sun, Aug 12, 2007 at 04:17:44PM +0100]
| > | Try this (it compiles but isnt tested). Its a weekend here, the sun is
| > | shining, the beach is a short walk, and I have more interesting things to
| > | do right now 8)
| > | 
| > | 
| [...]
| > | -int __vm_enough_memory(long pages, int cap_sys_admin)
| > | +int __vm_enough_memory(struct mm_struct *mm, long pages, int cap_sys_admin)
| > |  {
| > |  	unsigned long free, allowed;
| > |  
| > | @@ -166,7 +166,7 @@
| > |  
| > |  	/* Don't let a single process grow too big:
| > |  	   leave 3% of the size of this process for other processes */
| > | -	allowed -= current->mm->total_vm / 32;
| > | +	allowed -= mm->total_vm / 32;
| > 
| > So mm->total_vm is 0 for __bprm_mm_init case. Is that ok? Or I miss
| > something?
| 
| Yeah, Alan adds mm to the interfaces and leaves us the question of
| "what mm to pass in when current->mm == NULL?" ;)
| 

Well, as I see, it seems the Alan's patch is correct. We pass
newly created mm to security_vm_enough_memory_mm() and get no errors
here even for overcommit = 2. But my question was that mm->total_vm
= 0 for this case and that is probably valid too I think. What about
the thing you pointed about? Well I think security_vm_enough_memory
should never be called from kernel thread (we have secrurity_vm_enough_memory_mm
for this). But I will check it more closely. Dont get me wrong - I'm not
VMM expert and may do errors ;)

		Cyrill

Re: [BUGFIX] NULL pointer dereference in __vm_enough_memory()

[Alan Cox]

> Well, as I see, it seems the Alan's patch is correct. We pass
> newly created mm to security_vm_enough_memory_mm() and get no errors
> here even for overcommit = 2. But my question was that mm->total_vm
> = 0 for this case and that is probably valid too I think. What about
> the thing you pointed about? Well I think security_vm_enough_memory
> should never be called from kernel thread (we have secrurity_vm_enough_memory_mm
> for this). But I will check it more closely. Dont get me wrong - I'm not
> VMM expert and may do errors ;)

A vma has to inserted into an mm struct so we are fine in terms of kernel
threads. init_bprm showed up a new case where we add vma's to an mm that
isn't current->mm. The rest of the vm subsystem supports this and there
are cases for the future (eg the usermode linux mm switching patch) where
it might matter that we do it right.

Alan

Re: [BUGFIX] NULL pointer dereference in __vm_enough_memory()

[Cyrill Gorcunov]

[Alan Cox - Mon, Aug 13, 2007 at 12:22:24PM +0100]
| > Well, as I see, it seems the Alan's patch is correct. We pass
| > newly created mm to security_vm_enough_memory_mm() and get no errors
| > here even for overcommit = 2. But my question was that mm->total_vm
| > = 0 for this case and that is probably valid too I think. What about
| > the thing you pointed about? Well I think security_vm_enough_memory
| > should never be called from kernel thread (we have secrurity_vm_enough_memory_mm
| > for this). But I will check it more closely. Dont get me wrong - I'm not
| > VMM expert and may do errors ;)
| 
| A vma has to inserted into an mm struct so we are fine in terms of kernel
| threads. init_bprm showed up a new case where we add vma's to an mm that
| isn't current->mm. The rest of the vm subsystem supports this and there
| are cases for the future (eg the usermode linux mm switching patch) where
| it might matter that we do it right.
| 
| Alan
| 

ok, thanks for explanation, Alan.

		Cyrill

Re: [BUGFIX] NULL pointer dereference in __vm_enough_memory()

[Rene Herman]

On 08/12/2007 05:17 PM, Alan Cox wrote:

> Try this (it compiles but isnt tested). Its a weekend here, the sun is
> shining, the beach is a short walk, and I have more interesting things to
> do right now 8)

Oh come on, you have a beard. You can't go to the beach.

Rene.

Re: [BUGFIX] NULL pointer dereference in __vm_enough_memory()

[WU Fengguang]

On Sun, Aug 12, 2007 at 04:17:44PM +0100, Alan Cox wrote:
> Try this (it compiles but isnt tested). Its a weekend here, the sun is
> shining, the beach is a short walk, and I have more interesting things to
> do right now 8)

Have a nice day~~~ It works!

> --- linux.vanilla-2.6.23rc1-mm1/mm/mmap.c	2007-07-26 15:02:58.000000000 +0100
> +++ linux-2.6.23rc1-mm1/mm/mmap.c	2007-08-12 13:53:22.000000000 +0100
> @@ -2058,7 +2058,7 @@
>  	if (__vma && __vma->vm_start < vma->vm_end)
>  		return -ENOMEM;
>  	if ((vma->vm_flags & VM_ACCOUNT) &&
> -	     security_vm_enough_memory(vma_pages(vma)))
> +	     security_vm_enough_memory_mm(mm, vma_pages(vma)))
>  		return -ENOMEM;
>  	vma_link(mm, vma, prev, rb_link, rb_parent);
>  	return 0;

Sorry, I overlooked this chunk in int insert_vm_struct(mm, vma), hehe.

[PATCH] fix NULL pointer dereference in __vm_enough_memory()

[Alan Cox]

On Mon, 13 Aug 2007 15:38:53 +0800
WU Fengguang <wfg@mail.ustc.edu.cn> wrote:

> On Sun, Aug 12, 2007 at 04:17:44PM +0100, Alan Cox wrote:
> > Try this (it compiles but isnt tested). Its a weekend here, the sun is
> > shining, the beach is a short walk, and I have more interesting things to
> > do right now 8)
> 
> Have a nice day~~~ It works!

Ok please apply the patch then Andrew

---

The new exec code inserts an accounted vma into an mm struct which is not
current->mm. The existing memory check code has a hard coded assumption
that this does not happen as does the security code.

As the correct mm is known we pass the mm to the security method and the
helper function. A new security test is added for the case where we need
to pass the mm and the existing one is modified to pass current->mm to
avoid the need to change large amounts of code.

Signed-off-by: Alan Cox <alan@redhat.com>


diff -u --new-file --recursive --exclude-from /usr/src/exclude linux.vanilla-2.6.23rc1-mm1/include/linux/mm.h linux-2.6.23rc1-mm1/include/linux/mm.h
--- linux.vanilla-2.6.23rc1-mm1/include/linux/mm.h	2007-07-26 15:02:58.000000000 +0100
+++ linux-2.6.23rc1-mm1/include/linux/mm.h	2007-08-12 13:54:24.614647536 +0100
@@ -1079,7 +1079,7 @@
 }
 
 /* mmap.c */
-extern int __vm_enough_memory(long pages, int cap_sys_admin);
+extern int __vm_enough_memory(struct mm_struct *mm, long pages, int cap_sys_admin);
 extern void vma_adjust(struct vm_area_struct *vma, unsigned long start,
 	unsigned long end, pgoff_t pgoff, struct vm_area_struct *insert);
 extern struct vm_area_struct *vma_merge(struct mm_struct *,
diff -u --new-file --recursive --exclude-from /usr/src/exclude linux.vanilla-2.6.23rc1-mm1/include/linux/security.h linux-2.6.23rc1-mm1/include/linux/security.h
--- linux.vanilla-2.6.23rc1-mm1/include/linux/security.h	2007-07-26 15:02:58.000000000 +0100
+++ linux-2.6.23rc1-mm1/include/linux/security.h	2007-08-12 14:13:10.383504656 +0100
@@ -58,7 +58,7 @@
 extern int cap_task_setioprio (struct task_struct *p, int ioprio);
 extern int cap_task_setnice (struct task_struct *p, int nice);
 extern int cap_syslog (int type);
-extern int cap_vm_enough_memory (long pages);
+extern int cap_vm_enough_memory (struct mm_struct *mm, long pages);
 
 struct msghdr;
 struct sk_buff;
@@ -1129,6 +1129,7 @@
  *	Return 0 if permission is granted.
  * @vm_enough_memory:
  *	Check permissions for allocating a new virtual mapping.
+ *	@mm contains the mm struct it is being added to.
  *      @pages contains the number of pages.
  *	Return 0 if permission is granted.
  *
@@ -1173,7 +1174,7 @@
 	int (*quota_on) (struct dentry * dentry);
 	int (*syslog) (int type);
 	int (*settime) (struct timespec *ts, struct timezone *tz);
-	int (*vm_enough_memory) (long pages);
+	int (*vm_enough_memory) (struct mm_struct *mm, long pages);
 
 	int (*bprm_alloc_security) (struct linux_binprm * bprm);
 	void (*bprm_free_security) (struct linux_binprm * bprm);
@@ -1439,6 +1440,7 @@
 int security_syslog(int type);
 int security_settime(struct timespec *ts, struct timezone *tz);
 int security_vm_enough_memory(long pages);
+int security_vm_enough_memory_mm(struct mm_struct *mm, long pages);
 int security_bprm_alloc(struct linux_binprm *bprm);
 void security_bprm_free(struct linux_binprm *bprm);
 void security_bprm_apply_creds(struct linux_binprm *bprm, int unsafe);
diff -u --new-file --recursive --exclude-from /usr/src/exclude linux.vanilla-2.6.23rc1-mm1/mm/mmap.c linux-2.6.23rc1-mm1/mm/mmap.c
--- linux.vanilla-2.6.23rc1-mm1/mm/mmap.c	2007-07-26 15:02:58.000000000 +0100
+++ linux-2.6.23rc1-mm1/mm/mmap.c	2007-08-12 13:53:22.000000000 +0100
@@ -93,7 +93,7 @@
  * Note this is a helper function intended to be used by LSMs which
  * wish to use this logic.
  */
-int __vm_enough_memory(long pages, int cap_sys_admin)
+int __vm_enough_memory(struct mm_struct *mm, long pages, int cap_sys_admin)
 {
 	unsigned long free, allowed;
 
@@ -166,7 +166,7 @@
 
 	/* Don't let a single process grow too big:
 	   leave 3% of the size of this process for other processes */
-	allowed -= current->mm->total_vm / 32;
+	allowed -= mm->total_vm / 32;
 
 	/*
 	 * cast `allowed' as a signed long because vm_committed_space
@@ -2058,7 +2058,7 @@
 	if (__vma && __vma->vm_start < vma->vm_end)
 		return -ENOMEM;
 	if ((vma->vm_flags & VM_ACCOUNT) &&
-	     security_vm_enough_memory(vma_pages(vma)))
+	     security_vm_enough_memory_mm(mm, vma_pages(vma)))
 		return -ENOMEM;
 	vma_link(mm, vma, prev, rb_link, rb_parent);
 	return 0;
diff -u --new-file --recursive --exclude-from /usr/src/exclude linux.vanilla-2.6.23rc1-mm1/mm/nommu.c linux-2.6.23rc1-mm1/mm/nommu.c
--- linux.vanilla-2.6.23rc1-mm1/mm/nommu.c	2007-07-26 15:02:08.000000000 +0100
+++ linux-2.6.23rc1-mm1/mm/nommu.c	2007-08-12 13:53:57.000000000 +0100
@@ -1270,7 +1270,7 @@
  * Note this is a helper function intended to be used by LSMs which
  * wish to use this logic.
  */
-int __vm_enough_memory(long pages, int cap_sys_admin)
+int __vm_enough_memory(struct mm_struct *mm, long pages, int cap_sys_admin)
 {
 	unsigned long free, allowed;
 
diff -u --new-file --recursive --exclude-from /usr/src/exclude linux.vanilla-2.6.23rc1-mm1/security/commoncap.c linux-2.6.23rc1-mm1/security/commoncap.c
--- linux.vanilla-2.6.23rc1-mm1/security/commoncap.c	2007-07-26 15:02:59.000000000 +0100
+++ linux-2.6.23rc1-mm1/security/commoncap.c	2007-08-12 14:13:29.000000000 +0100
@@ -489,13 +489,13 @@
 	return 0;
 }
 
-int cap_vm_enough_memory(long pages)
+int cap_vm_enough_memory(struct mm_struct *mm, long pages)
 {
 	int cap_sys_admin = 0;
 
 	if (cap_capable(current, CAP_SYS_ADMIN) == 0)
 		cap_sys_admin = 1;
-	return __vm_enough_memory(pages, cap_sys_admin);
+	return __vm_enough_memory(mm, pages, cap_sys_admin);
 }
 
 EXPORT_SYMBOL(cap_capable);
diff -u --new-file --recursive --exclude-from /usr/src/exclude linux.vanilla-2.6.23rc1-mm1/security/dummy.c linux-2.6.23rc1-mm1/security/dummy.c
--- linux.vanilla-2.6.23rc1-mm1/security/dummy.c	2007-07-26 15:02:59.000000000 +0100
+++ linux-2.6.23rc1-mm1/security/dummy.c	2007-08-12 14:10:49.000000000 +0100
@@ -107,13 +107,13 @@
 	return 0;
 }
 
-static int dummy_vm_enough_memory(long pages)
+static int dummy_vm_enough_memory(struct mm_struct *mm, long pages)
 {
 	int cap_sys_admin = 0;
 
 	if (dummy_capable(current, CAP_SYS_ADMIN) == 0)
 		cap_sys_admin = 1;
-	return __vm_enough_memory(pages, cap_sys_admin);
+	return __vm_enough_memory(mm, pages, cap_sys_admin);
 }
 
 static int dummy_bprm_alloc_security (struct linux_binprm *bprm)
diff -u --new-file --recursive --exclude-from /usr/src/exclude linux.vanilla-2.6.23rc1-mm1/security/security.c linux-2.6.23rc1-mm1/security/security.c
--- linux.vanilla-2.6.23rc1-mm1/security/security.c	2007-07-26 15:02:59.000000000 +0100
+++ linux-2.6.23rc1-mm1/security/security.c	2007-08-12 13:47:53.000000000 +0100
@@ -237,10 +237,14 @@
 	return security_ops->settime(ts, tz);
 }
 
-
 int security_vm_enough_memory(long pages)
 {
-	return security_ops->vm_enough_memory(pages);
+	return security_ops->vm_enough_memory(current->mm, pages);
+}
+
+int security_vm_enough_memory_mm(struct mm_struct *mm, long pages)
+{
+	return security_ops->vm_enough_memory(mm, pages);
 }
 
 int security_bprm_alloc(struct linux_binprm *bprm)
diff -u --new-file --recursive --exclude-from /usr/src/exclude linux.vanilla-2.6.23rc1-mm1/security/selinux/hooks.c linux-2.6.23rc1-mm1/security/selinux/hooks.c
--- linux.vanilla-2.6.23rc1-mm1/security/selinux/hooks.c	2007-07-26 15:02:59.000000000 +0100
+++ linux-2.6.23rc1-mm1/security/selinux/hooks.c	2007-08-12 14:11:21.000000000 +0100
@@ -1584,7 +1584,7 @@
  * Do not audit the selinux permission check, as this is applied to all
  * processes that allocate mappings.
  */
-static int selinux_vm_enough_memory(long pages)
+static int selinux_vm_enough_memory(struct mm_struct *mm, long pages)
 {
 	int rc, cap_sys_admin = 0;
 	struct task_security_struct *tsec = current->security;
@@ -1600,7 +1600,7 @@
 	if (rc == 0)
 		cap_sys_admin = 1;
 
-	return __vm_enough_memory(pages, cap_sys_admin);
+	return __vm_enough_memory(mm, pages, cap_sys_admin);
 }
 
 /* binprm security operations */

Re: [PATCH] fix NULL pointer dereference in __vm_enough_memory()

[Andrew Morton]

On Mon, 13 Aug 2007 14:01:06 +0100 Alan Cox <alan@lxorguk.ukuu.org.uk> wrote:

> On Mon, 13 Aug 2007 15:38:53 +0800
> WU Fengguang <wfg@mail.ustc.edu.cn> wrote:
> 
> > On Sun, Aug 12, 2007 at 04:17:44PM +0100, Alan Cox wrote:
> > > Try this (it compiles but isnt tested). Its a weekend here, the sun is
> > > shining, the beach is a short walk, and I have more interesting things to
> > > do right now 8)
> > 
> > Have a nice day~~~ It works!
> 
> Ok please apply the patch then Andrew
> 
> ---
> 
> The new exec code inserts an accounted vma into an mm struct which is not
> current->mm. The existing memory check code has a hard coded assumption
> that this does not happen as does the security code.
> 
> As the correct mm is known we pass the mm to the security method and the
> helper function. A new security test is added for the case where we need
> to pass the mm and the existing one is modified to pass current->mm to
> avoid the need to change large amounts of code.
> 
> Signed-off-by: Alan Cox <alan@redhat.com>
> 
> 
> diff -u --new-file --recursive --exclude-from /usr/src/exclude linux.vanilla-2.6.23rc1-mm1/include/linux/mm.h linux-2.6.23rc1-mm1/include/linux/mm.h
> --- linux.vanilla-2.6.23rc1-mm1/include/linux/mm.h	2007-07-26 15:02:58.000000000 +0100

erp, we have major version skew between 2.6.23-rc1-mm1 and 2.6.23-rc3 here, sorry.

Could I ask for a redone patch against mainline?

Thanks.

Re: [PATCH] fix NULL pointer dereference in __vm_enough_memory()

[Tobias Diedrich]

Andrew Morton wrote:

> erp, we have major version skew between 2.6.23-rc1-mm1 and 2.6.23-rc3 here, sorry.
> 
> Could I ask for a redone patch against mainline?

Since I'm seeing this problem on 2.6.23-rc3, I tried adapting it.
I'm running it now and the NULL pointer messages are gone.

Index: linux-2.6.23-rc3/include/linux/mm.h
===================================================================
--- linux-2.6.23-rc3.orig/include/linux/mm.h	2007-08-14 18:33:09.000000000 +0200
+++ linux-2.6.23-rc3/include/linux/mm.h	2007-08-14 19:31:59.000000000 +0200
@@ -1042,7 +1042,7 @@
 }
 
 /* mmap.c */
-extern int __vm_enough_memory(long pages, int cap_sys_admin);
+extern int __vm_enough_memory(struct mm_struct *mm, long pages, int cap_sys_admin);
 extern void vma_adjust(struct vm_area_struct *vma, unsigned long start,
 	unsigned long end, pgoff_t pgoff, struct vm_area_struct *insert);
 extern struct vm_area_struct *vma_merge(struct mm_struct *,
Index: linux-2.6.23-rc3/include/linux/security.h
===================================================================
--- linux-2.6.23-rc3.orig/include/linux/security.h	2007-08-14 18:33:10.000000000 +0200
+++ linux-2.6.23-rc3/include/linux/security.h	2007-08-14 19:38:24.000000000 +0200
@@ -54,7 +54,7 @@
 extern int cap_task_post_setuid (uid_t old_ruid, uid_t old_euid, uid_t old_suid, int flags);
 extern void cap_task_reparent_to_init (struct task_struct *p);
 extern int cap_syslog (int type);
-extern int cap_vm_enough_memory (long pages);
+extern int cap_vm_enough_memory (struct mm_struct *mm, long pages);
 
 struct msghdr;
 struct sk_buff;
@@ -1125,6 +1125,7 @@
  *	Return 0 if permission is granted.
  * @vm_enough_memory:
  *	Check permissions for allocating a new virtual mapping.
+ *	@mm contains the mm struct it is being added to.
  *      @pages contains the number of pages.
  *	Return 0 if permission is granted.
  *
@@ -1169,7 +1170,7 @@
 	int (*quota_on) (struct dentry * dentry);
 	int (*syslog) (int type);
 	int (*settime) (struct timespec *ts, struct timezone *tz);
-	int (*vm_enough_memory) (long pages);
+	int (*vm_enough_memory) (struct mm_struct *mm, long pages);
 
 	int (*bprm_alloc_security) (struct linux_binprm * bprm);
 	void (*bprm_free_security) (struct linux_binprm * bprm);
@@ -1469,10 +1470,14 @@
 	return security_ops->settime(ts, tz);
 }
 
-
 static inline int security_vm_enough_memory(long pages)
 {
-	return security_ops->vm_enough_memory(pages);
+	return security_ops->vm_enough_memory(current->mm, pages);
+}
+
+static inline int security_vm_enough_memory_mm(struct mm_struct *mm, long pages)
+{
+	return security_ops->vm_enough_memory(mm, pages);
 }
 
 static inline int security_bprm_alloc (struct linux_binprm *bprm)
@@ -2219,7 +2224,12 @@
 
 static inline int security_vm_enough_memory(long pages)
 {
-	return cap_vm_enough_memory(pages);
+	return cap_vm_enough_memory(current->mm, pages);
+}
+
+static inline int security_vm_enough_memory_mm(struct mm_struct *mm, long pages)
+{
+	return cap_vm_enough_memory(mm, pages);
 }
 
 static inline int security_bprm_alloc (struct linux_binprm *bprm)
Index: linux-2.6.23-rc3/mm/mmap.c
===================================================================
--- linux-2.6.23-rc3.orig/mm/mmap.c	2007-08-14 18:33:11.000000000 +0200
+++ linux-2.6.23-rc3/mm/mmap.c	2007-08-14 19:31:59.000000000 +0200
@@ -93,7 +93,7 @@
  * Note this is a helper function intended to be used by LSMs which
  * wish to use this logic.
  */
-int __vm_enough_memory(long pages, int cap_sys_admin)
+int __vm_enough_memory(struct mm_struct *mm, long pages, int cap_sys_admin)
 {
 	unsigned long free, allowed;
 
@@ -166,7 +166,7 @@
 
 	/* Don't let a single process grow too big:
 	   leave 3% of the size of this process for other processes */
-	allowed -= current->mm->total_vm / 32;
+	allowed -= mm->total_vm / 32;
 
 	/*
 	 * cast `allowed' as a signed long because vm_committed_space
@@ -2077,7 +2077,7 @@
 	if (__vma && __vma->vm_start < vma->vm_end)
 		return -ENOMEM;
 	if ((vma->vm_flags & VM_ACCOUNT) &&
-	     security_vm_enough_memory(vma_pages(vma)))
+	     security_vm_enough_memory_mm(mm, vma_pages(vma)))
 		return -ENOMEM;
 	vma_link(mm, vma, prev, rb_link, rb_parent);
 	return 0;
Index: linux-2.6.23-rc3/mm/nommu.c
===================================================================
--- linux-2.6.23-rc3.orig/mm/nommu.c	2007-08-14 18:33:12.000000000 +0200
+++ linux-2.6.23-rc3/mm/nommu.c	2007-08-14 19:31:59.000000000 +0200
@@ -1270,7 +1270,7 @@
  * Note this is a helper function intended to be used by LSMs which
  * wish to use this logic.
  */
-int __vm_enough_memory(long pages, int cap_sys_admin)
+int __vm_enough_memory(struct mm_struct *mm, long pages, int cap_sys_admin)
 {
 	unsigned long free, allowed;
 
Index: linux-2.6.23-rc3/security/commoncap.c
===================================================================
--- linux-2.6.23-rc3.orig/security/commoncap.c	2007-08-14 18:33:13.000000000 +0200
+++ linux-2.6.23-rc3/security/commoncap.c	2007-08-14 19:31:59.000000000 +0200
@@ -315,13 +315,13 @@
 	return 0;
 }
 
-int cap_vm_enough_memory(long pages)
+int cap_vm_enough_memory(struct mm_struct *mm, long pages)
 {
 	int cap_sys_admin = 0;
 
 	if (cap_capable(current, CAP_SYS_ADMIN) == 0)
 		cap_sys_admin = 1;
-	return __vm_enough_memory(pages, cap_sys_admin);
+	return __vm_enough_memory(mm, pages, cap_sys_admin);
 }
 
 EXPORT_SYMBOL(cap_capable);
Index: linux-2.6.23-rc3/security/dummy.c
===================================================================
--- linux-2.6.23-rc3.orig/security/dummy.c	2007-08-14 18:33:13.000000000 +0200
+++ linux-2.6.23-rc3/security/dummy.c	2007-08-14 19:31:59.000000000 +0200
@@ -108,13 +108,13 @@
 	return 0;
 }
 
-static int dummy_vm_enough_memory(long pages)
+static int dummy_vm_enough_memory(struct mm_struct *mm, long pages)
 {
 	int cap_sys_admin = 0;
 
 	if (dummy_capable(current, CAP_SYS_ADMIN) == 0)
 		cap_sys_admin = 1;
-	return __vm_enough_memory(pages, cap_sys_admin);
+	return __vm_enough_memory(mm, pages, cap_sys_admin);
 }
 
 static int dummy_bprm_alloc_security (struct linux_binprm *bprm)
Index: linux-2.6.23-rc3/security/selinux/hooks.c
===================================================================
--- linux-2.6.23-rc3.orig/security/selinux/hooks.c	2007-08-14 18:33:13.000000000 +0200
+++ linux-2.6.23-rc3/security/selinux/hooks.c	2007-08-14 19:31:59.000000000 +0200
@@ -1584,7 +1584,7 @@
  * Do not audit the selinux permission check, as this is applied to all
  * processes that allocate mappings.
  */
-static int selinux_vm_enough_memory(long pages)
+static int selinux_vm_enough_memory(struct mm_struct *mm, long pages)
 {
 	int rc, cap_sys_admin = 0;
 	struct task_security_struct *tsec = current->security;
@@ -1600,7 +1600,7 @@
 	if (rc == 0)
 		cap_sys_admin = 1;
 
-	return __vm_enough_memory(pages, cap_sys_admin);
+	return __vm_enough_memory(mm, pages, cap_sys_admin);
 }
 
 /* binprm security operations */

-- 
Tobias						PGP: http://9ac7e0bc.uguu.de
このメールは十割再利用されたビットで作られています。

Re: [BUGFIX] NULL pointer dereference in __vm_enough_memory()

[Andy Isaacson]

On Sun, Aug 12, 2007 at 08:27:46PM +0800, WU Fengguang wrote:
> On Sun, Aug 12, 2007 at 05:27:52PM +0530, Balbir Singh wrote:
> > For some reason my mailer keeps removing you from the cc.
> 
> Or maybe it's my SMTP server's problem. Email systems are complex.

It's the Mail-Followup-To header you include in your emails:

> Mail-Followup-To: Balbir Singh <balbir@linux.vnet.ibm.com>,
>        Andrew Morton <akpm@linux-foundation.org>,
>        linux-kernel <linux-kernel@vger.kernel.org>

The mail clients are just doing what you asked.  Perhaps you need to
turn off followup_to (and turn on edit_headers).

Mutt has "set honor_followup_to=ask-yes" to fix this in 1.5 (though it's
broken in "1.4.2.2i"); I don't know if the GUI clients have such a
switch.

-andy

Re: [BUGFIX] NULL pointer dereference in __vm_enough_memory()

[WU Fengguang]

On Tue, Aug 14, 2007 at 10:10:58AM -0700, Andy Isaacson wrote:
> On Sun, Aug 12, 2007 at 08:27:46PM +0800, WU Fengguang wrote:
> > On Sun, Aug 12, 2007 at 05:27:52PM +0530, Balbir Singh wrote:
> > > For some reason my mailer keeps removing you from the cc.
> > 
> > Or maybe it's my SMTP server's problem. Email systems are complex.
> 
> It's the Mail-Followup-To header you include in your emails:
> 
> > Mail-Followup-To: Balbir Singh <balbir@linux.vnet.ibm.com>,
> >        Andrew Morton <akpm@linux-foundation.org>,
> >        linux-kernel <linux-kernel@vger.kernel.org>
> 
> The mail clients are just doing what you asked.  Perhaps you need to
> turn off followup_to (and turn on edit_headers).
> 
> Mutt has "set honor_followup_to=ask-yes" to fix this in 1.5 (though it's
> broken in "1.4.2.2i"); I don't know if the GUI clients have such a
> switch.

Thank you for the tip, it does the trick!

Andrew: I just realized that a false muttrc was "corrected". What a fool!