linux-kernel - Re: Bug in find_vma_prev

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Sat, 30 Jan 2010 19:29:47 +0100
From:	"Rafael J. Wysocki" <rjw@...k.pl>
To:	Tony Perkins <da.perk@...il.com>
Cc:	linux-kernel@...r.kernel.org,
	Andrew Morton <akpm@...ux-foundation.org>,
	"linux-mm@...ck.org" <linux-mm@...ck.org>
Subject: Re: Bug in find_vma_prev - mmap.c

[Adding CCs]

On Saturday 30 January 2010, Tony Perkins wrote:
> This code returns vma (mm->mmap) if it sees that addr is lower than first VMA.
> However, I think it falsely returns vma (mm->mmap) on the case where
> addr is in the first VMA.
> 
> If it is the first VMA region:
> - *pprev should be set to NULL
> - implying prev is NULL
> - and should therefore return vma (so in this case, I just added if
> it's the first VMA and it's within range)
> 
> /* Same as find_vma, but also return a pointer to the previous VMA in *pprev. */
> struct vm_area_struct *
> find_vma_prev(struct mm_struct *mm, unsigned long addr,
>             struct vm_area_struct **pprev)
> {
>     struct vm_area_struct *vma = NULL, *prev = NULL;
>     struct rb_node *rb_node;
>     if (!mm)
>         goto out;
> 
>     /* Guard against addr being lower than the first VMA */
>     vma = mm->mmap;
> 
>     /* Go through the RB tree quickly. */
>     rb_node = mm->mm_rb.rb_node;
> 
>     while (rb_node) {
>         struct vm_area_struct *vma_tmp;
>         vma_tmp = rb_entry(rb_node, struct vm_area_struct, vm_rb);
> 
>         if (addr < vma_tmp->vm_end) {
>             // TONY: if (vma_tmp->vm_start <= addr) vma = vma_tmp; //
> this returns the correct 'vma' when vma is the first node (i.e., no
> prev)
>             rb_node = rb_node->rb_left;
>         } else {
>             prev = vma_tmp;
>             if (!prev->vm_next || (addr < prev->vm_next->vm_end))
>                 break;
>             rb_node = rb_node->rb_right;
>         }
>     }
> 
> out:
>     *pprev = prev;
>     return prev ? prev->vm_next : vma;
> }
> 
> Is this a known issue and/or has this problem been addressed?
> Also, please CC my email address with responses.

Well, I guess you should let the mm people know (CCs added).

Rafael
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/