[PATCH] groups_alloc(0) badness

[Olaf Kirch <okir@suse.de>]

Hi,

We're looking into an nfsd oops that is caused by a corrupted
group_info struct. I haven't nailed down the exact cause of
the oops, but Marcus Meissner pointed out one problem in
the current groups_alloc code.

When we do groups_alloc(0), which can happen e.g. in the nfsd
code, the code allocates a group_info struct with _no_ space for
group_info->blocks. Nevertheless it proceeds to set 
group_info->blocks[0] = group_info->small_block, clobbering whatever is
after the group_info block.

Here's a pseudo-diff to kernel/sys.c:groups_alloc:
------------------------------------------------------------------

        nblocks = (gidsetsize/NGROUPS_PER_BLOCK) +
            (gidsetsize%NGROUPS_PER_BLOCK?1:0);
+	if (unlikely(nblocks == 0))
+		nblocks = 1
        group_info = kmalloc(sizeof(*group_info) + nblocks*sizeof(gid_t *),
            GFP_USER);
        if (!group_info)

------------------------------------------------------------------

Cheers
Olaf
-- 
Olaf Kirch     |  The Hardware Gods hate me.
okir@suse.de   |
---------------+ 


-------------------------------------------------------
This SF.Net email is sponsored by: IBM Linux Tutorials
Free Linux tutorial presented by Daniel Robbins, President and CEO of
GenToo technologies. Learn everything from fundamentals to system
administration.http://ads.osdn.com/?ad_id=1470&alloc_id=3638&op=click
_______________________________________________
NFS maillist  -  NFS@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/nfs