Sasha Levin 110ecd69a9 9p: fix off by one causing access violations and memory corruption ... p9_release_pages() would attempt to dereference one value past the end of pages[]. This would cause the following crashes: [ 6293.171817] BUG: unable to handle kernel paging request at ffff8807c96f3000 [ 6293.174146] IP: [<ffffffff8412793b>] p9_release_pages+0x3b/0x60 [ 6293.176447] PGD 79c5067 PUD 82c1e3067 PMD 82c197067 PTE 80000007c96f3060 [ 6293.180060] Oops: 0000 [#1] PREEMPT SMP DEBUG_PAGEALLOC [ 6293.180060] Modules linked in: [ 6293.180060] CPU: 62 PID: 174043 Comm: modprobe Tainted: G W 3.10.0-next-20130710-sasha #3954 [ 6293.180060] task: ffff8807b803b000 ti: ffff880787dde000 task.ti: ffff880787dde000 [ 6293.180060] RIP: 0010:[<ffffffff8412793b>] [<ffffffff8412793b>] p9_release_pages+0x3b/0x60 [ 6293.214316] RSP: 0000:ffff880787ddfc28 EFLAGS: 00010202 [ 6293.214316] RAX: 0000000000000001 RBX: ffff8807c96f2ff8 RCX: 0000000000000000 [ 6293.222017] RDX: ffff8807b803b000 RSI: 0000000000000001 RDI: ffffea001c7e3d40 [ 6293.222017] RBP: ffff880787ddfc48 R08: 0000000000000000 R09: 0000000000000000 [ 6293.222017] R10: 0000000000000001 R11: 0000000000000000 R12: 0000000000000001 [ 6293.222017] R13: 0000000000000001 R14: ffff8807cc50c070 R15: ffff8807cc50c070 [ 6293.222017] FS: 00007f572641d700(0000) GS:ffff8807f3600000(0000) knlGS:0000000000000000 [ 6293.256784] CS: 0010 DS: 0000 ES: 0000 CR0: 000000008005003b [ 6293.256784] CR2: ffff8807c96f3000 CR3: 00000007c8e81000 CR4: 00000000000006e0 [ 6293.256784] Stack: [ 6293.256784] ffff880787ddfcc8 ffff880787ddfcc8 0000000000000000 ffff880787ddfcc8 [ 6293.256784] ffff880787ddfd48 ffffffff84128be8 ffff880700000002 0000000000000001 [ 6293.256784] ffff8807b803b000 ffff880787ddfce0 0000100000000000 0000000000000000 [ 6293.256784] Call Trace: [ 6293.256784] [<ffffffff84128be8>] p9_virtio_zc_request+0x598/0x630 [ 6293.256784] [<ffffffff8115c610>] ? wake_up_bit+0x40/0x40 [ 6293.256784] [<ffffffff841209b1>] p9_client_zc_rpc+0x111/0x3a0 [ 6293.256784] [<ffffffff81174b78>] ? sched_clock_cpu+0x108/0x120 [ 6293.256784] [<ffffffff84122a21>] p9_client_read+0xe1/0x2c0 [ 6293.256784] [<ffffffff81708a90>] v9fs_file_read+0x90/0xc0 [ 6293.256784] [<ffffffff812bd073>] vfs_read+0xc3/0x130 [ 6293.256784] [<ffffffff811a78bd>] ? trace_hardirqs_on+0xd/0x10 [ 6293.256784] [<ffffffff812bd5a2>] SyS_read+0x62/0xa0 [ 6293.256784] [<ffffffff841a1a00>] tracesys+0xdd/0xe2 [ 6293.256784] Code: 66 90 48 89 fb 41 89 f5 48 8b 3f 48 85 ff 74 29 85 f6 74 25 45 31 e4 66 0f 1f 84 00 00 00 00 00 e8 eb 14 12 fd 41 ff c4 49 63 c4 <48> 8b 3c c3 48 85 ff 74 05 45 39 e5 75 e7 48 83 c4 08 5b 41 5c [ 6293.256784] RIP [<ffffffff8412793b>] p9_release_pages+0x3b/0x60 [ 6293.256784] RSP <ffff880787ddfc28> [ 6293.256784] CR2: ffff8807c96f3000 [ 6293.256784] ---[ end trace 50822ee72cd360fc ]--- Signed-off-by: Sasha Levin <sasha.levin@oracle.com> Signed-off-by: David S. Miller <davem@davemloft.net>		2013-07-11 11:36:02 -07:00
..
9p	9p: fix off by one causing access violations and memory corruption	2013-07-11 11:36:02 -07:00
802	net/802/mrp: fix lockdep splat	2013-05-14 13:02:30 -07:00
8021q	net: pass info struct via netdevice notifier	2013-05-28 13:11:01 -07:00
appletalk	net: pass info struct via netdevice notifier	2013-05-28 13:11:01 -07:00
atm	net: always pass struct netdev_notifier_info to netdevice notifiers	2013-05-28 21:58:54 -07:00
ax25	net: Convert uses of typedef ctl_table to struct ctl_table	2013-06-13 02:36:09 -07:00
batman-adv	net: Unmap fragment page once iterator is done	2013-06-24 01:46:01 -07:00
bluetooth	Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-next	2013-07-09 18:24:39 -07:00
bridge	bridge: fix some kernel warning in multicast timer	2013-07-06 18:12:47 -07:00
caif	net: pass info struct via netdevice notifier	2013-05-28 13:11:01 -07:00
can	net: pass info struct via netdevice notifier	2013-05-28 13:11:01 -07:00
ceph	libceph: call r_unsafe_callback when unsafe reply is received	2013-07-03 15:32:58 -07:00
core	net: rename busy poll socket op and globals	2013-07-10 17:08:27 -07:00
dcb	rtnetlink: Remove passing of attributes into rtnl_doit functions	2013-03-22 10:31:16 -04:00
dccp	tcp: Remove TCPCT	2013-03-17 14:35:13 -04:00
decnet	net: Convert uses of typedef ctl_table to struct ctl_table	2013-06-13 02:36:09 -07:00
dns_resolver
dsa	dsa: fix freeing of sparse port allocation	2013-03-25 12:23:41 -04:00
ethernet	net: add ETH_P_802_3_MIN	2013-03-28 01:20:42 -04:00
ieee802154	net: pass info struct via netdevice notifier	2013-05-28 13:11:01 -07:00
ipv4	net: rename ll methods to busy-poll	2013-07-10 17:08:27 -07:00
ipv6	ipv6: in case of link failure remove route directly instead of letting it expire	2013-07-10 19:45:39 -07:00
ipx	net: pass info struct via netdevice notifier	2013-05-28 13:11:01 -07:00
irda	net: Convert uses of typedef ctl_table to struct ctl_table	2013-06-13 02:36:09 -07:00
iucv	net: pass info struct via netdevice notifier	2013-05-28 13:11:01 -07:00
key	af_key: fix info leaks in notify messages	2013-06-26 15:15:54 -07:00
l2tp	l2tp: make datapath resilient to packet loss when sequence numbers enabled	2013-07-02 16:33:25 -07:00
lapb	net/lapb: remove depends on CONFIG_EXPERIMENTAL	2013-01-11 11:40:01 -08:00
llc	llc: Fix missing msg_namelen update in llc_ui_recvmsg()	2013-04-07 16:28:01 -04:00
mac80211	Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-next	2013-07-09 18:24:39 -07:00
mac802154	Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net	2013-04-30 03:55:20 -04:00
mpls	MPLS: Add limited GSO support	2013-05-27 22:50:59 -07:00
netfilter	Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net	2013-07-03 14:55:13 -07:00
netlabel	net: pass info struct via netdevice notifier	2013-05-28 13:11:01 -07:00
netlink	netlink: fix splat in skb_clone with large messages	2013-06-27 22:44:16 -07:00
netrom	net: Convert uses of typedef ctl_table to struct ctl_table	2013-06-13 02:36:09 -07:00
nfc	NFC: llcp: Fix the well known services endianness	2013-06-14 13:45:10 +02:00
openvswitch	openvswitch: Add Kconfig dependency on GRE-DEMUX.	2013-07-01 13:19:43 -07:00
packet	Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net	2013-06-19 16:49:39 -07:00
phonet	net: Convert uses of typedef ctl_table to struct ctl_table	2013-06-13 02:36:09 -07:00
rds	net: Convert uses of typedef ctl_table to struct ctl_table	2013-06-13 02:36:09 -07:00
rfkill	Merge branch 'for-john' of git://git.kernel.org/pub/scm/linux/kernel/git/jberg/mac80211-next	2013-04-22 14:58:14 -04:00
rose	net: Convert uses of typedef ctl_table to struct ctl_table	2013-06-13 02:36:09 -07:00
rxrpc	Driver core patches for 3.9-rc1	2013-02-21 12:05:51 -08:00
sched	netem: fix possible NULL deref in netem_dequeue()	2013-07-03 16:52:10 -07:00
sctp	net: sctp: confirm route during forward progress	2013-07-09 12:49:56 -07:00
sunrpc	Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-next	2013-07-09 18:24:39 -07:00
tipc	tipc: remove dev_base_lock use from enable_bearer	2013-06-17 15:53:01 -07:00
unix	Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-next	2013-07-09 18:24:39 -07:00
vmw_vsock	VSOCK: Fix VSOCK_HASH and VSOCK_CONN_HASH	2013-06-23 23:51:48 -07:00
wimax
wireless	Merge branch 'master' of git://git.kernel.org/pub/scm/linux/kernel/git/linville/wireless-next into for-davem	2013-06-28 13:18:21 -04:00
x25	x25: Fix broken locking in ioctl error paths.	2013-07-01 18:15:25 -07:00
xfrm	Merge branch 'master' of git://git.kernel.org/pub/scm/linux/kernel/git/klassert/ipsec-next	2013-06-26 13:23:13 -07:00
compat.c	net: Unbreak compat_sys_{send,recv}msg	2013-06-06 11:52:14 -07:00
Kconfig	Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-next	2013-07-09 18:24:39 -07:00
Makefile	MPLS: Add limited GSO support	2013-05-27 22:50:59 -07:00
nonet.c
socket.c	net: rename busy poll socket op and globals	2013-07-10 17:08:27 -07:00
sysctl_net.c