xavi/android_kernel_m2note/mm/swapfile.c, branch ng-7.1.2Unnamed repository; edit this file 'description' to name the repository.
https://gitea.privatedns.org/xavi/android_kernel_m2note/atom?h=ng-7.1.22017-04-11T08:58:02+00:00swapfile: fix memory corruption via malformed swapfile2017-04-11T08:58:02+00:00Jann Hornjann@thejh.net2016-11-10T18:46:19+00:00urn:sha1:73c2bebf9b78c638d58f4e8a58a84c2bd0363b02
commit dd111be69114cc867f8e826284559bfbc1c40e37 upstream.
When root activates a swap partition whose header has the wrong
endianness, nr_badpages elements of badpages are swabbed before
nr_badpages has been checked, leading to a buffer overrun of up to 8GB.
This normally is not a security issue because it can only be exploited
by root (more specifically, a process with CAP_SYS_ADMIN or the ability
to modify a swap file/partition), and such a process can already e.g.
modify swapped-out memory of any other userspace process on the system.
Link: http://lkml.kernel.org/r/1477949533-2509-1-git-send-email-jann@thejh.net
Signed-off-by: Jann Horn <jann@thejh.net>
Acked-by: Kees Cook <keescook@chromium.org>
Acked-by: Jerome Marchand <jmarchan@redhat.com>
Acked-by: Johannes Weiner <hannes@cmpxchg.org>
Cc: "Kirill A. Shutemov" <kirill.shutemov@linux.intel.com>
Cc: Vlastimil Babka <vbabka@suse.cz>
Cc: Hugh Dickins <hughd@google.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Willy Tarreau <w@1wt.eu>
first commit2016-08-15T02:19:42+00:00Meizu OpenSourcepatchwork@meizu.com2016-08-15T02:19:42+00:00urn:sha1:d2e1446d81725c351dc73a03b397ce043fb18452