apfs/linux-apfs
0
0
Fork 0
mirror of https://github.com/linux-apfs/linux-apfs.git synced 2026-05-01 15:00:59 -07:00
Code Issues Packages Projects Releases Wiki Activity

[PATCH] reject corrupt swapfiles earlier

Browse Source 
The fsfuzzer found this; with a corrupt small swapfile that claims to have
many pages:

  [root]# file swap.741.img
  swap.741.img: Linux/i386 swap file (new style) 1 (4K pages) size 1040191487 pages
  [root]# ls -l swap.741.img
  -rw-r--r-- 1 root root 16777216 Nov 22 05:18 swap.741.img

sys_swapon() will try to vmalloc all those pages, and -then- check to see if
the file is actually that large:

                if (!(p->swap_map = vmalloc(maxpages * sizeof(short)))) {
  <snip>
        if (swapfilesize && maxpages > swapfilesize) {
                printk(KERN_WARNING
                       "Swap area shorter than signature indicates\n");

It seems to me that it would make more sense to move this test up before
the vmalloc, with the other checks, to avoid the OOM-killer in this
situation...

Signed-off-by: Eric Sandeen <sandeen@redhat.com>
Cc: Hugh Dickins <hugh@veritas.com>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>
This commit is contained in:
Eric Sandeen
2006-12-06 20:33:06 -08:00
committed by Linus Torvalds
parent 4af2bfc120
commit 5d1854e15e
1 changed files with 5 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files
mm/swapfile.c
+5 -6
View File
@@ -1552,6 +1552,11 @@ asmlinkage long sys_swapon(const char __user * specialfile, int swap_flags)
error = -EINVAL; error = -EINVAL;
if (!maxpages) if (!maxpages)
goto bad_swap; goto bad_swap;
if (swapfilesize && maxpages > swapfilesize) {
printk(KERN_WARNING
"Swap area shorter than signature indicates\n");
goto bad_swap;
}
if (swap_header->info.nr_badpages && S_ISREG(inode->i_mode)) if (swap_header->info.nr_badpages && S_ISREG(inode->i_mode))
goto bad_swap; goto bad_swap;
if (swap_header->info.nr_badpages > MAX_SWAP_BADPAGES) if (swap_header->info.nr_badpages > MAX_SWAP_BADPAGES)
@@ -1579,12 +1584,6 @@ asmlinkage long sys_swapon(const char __user * specialfile, int swap_flags)
goto bad_swap; goto bad_swap;
} }
if (swapfilesize && maxpages > swapfilesize) {
printk(KERN_WARNING
"Swap area shorter than signature indicates\n");
error = -EINVAL;
goto bad_swap;
}
if (nr_good_pages) { if (nr_good_pages) {
p->swap_map[0] = SWAP_MAP_BAD; p->swap_map[0] = SWAP_MAP_BAD;
p->max = maxpages; p->max = maxpages;