From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Message-Id: <20120205220953.045255935@pcw.home.local> Date: Sun, 05 Feb 2012 23:11:13 +0100 From: Willy Tarreau To: linux-kernel@vger.kernel.org, stable@vger.kernel.org Cc: Ludwig Nussel , Linus Torvalds , harvey.harrison@gmail.com, "H. Peter Anvin" , Andrew Morton , Ingo Molnar , Greg KH Subject: [PATCH 84/91] x86: Fix mmap random address range In-Reply-To: <0635750f5f06ed2ca212b91fcb5c4483@local> Sender: linux-kernel-owner@vger.kernel.org List-ID: 2.6.27-longterm review patch. If anyone has any objections, please let us know. ------------------ commit 9af0c7a6fa860698d080481f24a342ba74b68982 upstream. On x86_32 casting the unsigned int result of get_random_int() to long may result in a negative value. On x86_32 the range of mmap_rnd() therefore was -255 to 255. The 32bit mode on x86_64 used 0 to 255 as intended. The bug was introduced by 675a081 ("x86: unify mmap_{32|64}.c") in January 2008. Signed-off-by: Ludwig Nussel Cc: Linus Torvalds Cc: harvey.harrison@gmail.com Cc: "H. Peter Anvin" Cc: Harvey Harrison Signed-off-by: Andrew Morton Link: http://lkml.kernel.org/r/201111152246.pAFMklOB028527@wpaz5.hot.corp.google.com Signed-off-by: Ingo Molnar Signed-off-by: Greg Kroah-Hartman --- arch/x86/mm/mmap.c | 4 ++-- 1 files changed, 2 insertions(+), 2 deletions(-) Index: longterm-2.6.27/arch/x86/mm/mmap.c =================================================================== --- longterm-2.6.27.orig/arch/x86/mm/mmap.c 2012-02-05 22:34:32.437915058 +0100 +++ longterm-2.6.27/arch/x86/mm/mmap.c 2012-02-05 22:34:46.864914382 +0100 @@ -87,9 +87,9 @@ */ if (current->flags & PF_RANDOMIZE) { if (mmap_is_ia32()) - rnd = (long)get_random_int() % (1<<8); + rnd = get_random_int() % (1<<8); else - rnd = (long)(get_random_int() % (1<<28)); + rnd = get_random_int() % (1<<28); } return rnd << PAGE_SHIFT; }