groups_alloc(0) badness

Hi,

We're looking into an nfsd oops that is caused by a corrupted group_info struct. I haven't nailed down the exact cause of the oops, but Marcus Meissner pointed out one problem in the current groups_alloc code.

When we do groups_alloc(0), which can happen e.g. in the nfsd code, the code allocates a group_info struct with _no_ space for group_info->blocks. Nevertheless it proceeds to set group_info->blocks[0] = group_info->small_block, clobbering whatever is after the group_info block.

Here's a pseudo-diff to kernel/sys.c:groups_alloc:
------------------------------------------------------------------

nblocks = (gidsetsize/NGROUPS_PER_BLOCK) +
(gidsetsize%NGROUPS_PER_BLOCK?1:0);
+ if (unlikely(nblocks == 0))
+ nblocks = 1
group_info = kmalloc(sizeof(*group_info) + nblocks*sizeof(gid_t *),
GFP_USER);
if (!group_info)

------------------------------------------------------------------

Cheers
Olaf

Olaf Kirch     |  The Hardware Gods hate me.
[email protected]   |
---------------+ 


-------------------------------------------------------
This SF.Net email is sponsored by: IBM Linux Tutorials
Free Linux tutorial presented by Daniel Robbins, President and CEO of
GenToo technologies. Learn everything from fundamentals to system
administration.http://ads.osdn.com/?ad_id=1470&alloc_id=3638&op=click
_______________________________________________
NFS maillist  -  [email protected]
https://lists.sourceforge.net/lists/listinfo/nfs