linux-kernel - Re: 2.6.27-rc1: IP: iov_iter

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Thu, 31 Jul 2008 02:32:33 +0400
From:	Alexey Dobriyan <adobriyan@...il.com>
To:	Linus Torvalds <torvalds@...ux-foundation.org>
Cc:	akpm@...uxfoundation.org, Nick Piggin <npiggin@...e.de>,
	Linux Kernel Mailing List <linux-kernel@...r.kernel.org>,
	stable@...nel.org
Subject: Re: 2.6.27-rc1: IP: iov_iter_advance+0x2e/0x90

On Wed, Jul 30, 2008 at 03:02:32PM -0700, Linus Torvalds wrote:
> On Wed, 30 Jul 2008, Linus Torvalds wrote:
> > 
> > Ok, I'll commit it as obvious, ugly as it may be. And hope that Nick or 
> > some other god of iov_iter will think about trying to make these things 
> > more reliable and easier to use.
> 
> Oh, and I think it's stable material. Unless I misread something, this 
> area hasn't changed since 2.6.25. But somebody should double-check me, 
> that just sounds wrong.

2.6.26 fails the same way and patch also seems to help.

> commit 94ad374a0751f40d25e22e036c37f7263569d24c
> Author: Linus Torvalds <torvalds@...ux-foundation.org>
> Date:   Wed Jul 30 14:45:12 2008 -0700
> 
>     Fix off-by-one error in iov_iter_advance()
>     
>     The iov_iter_advance() function would look at the iov->iov_len entry
>     even though it might have iterated over the whole array, and iov was
>     pointing past the end.  This would cause DEBUG_PAGEALLOC to trigger a
>     kernel page fault if the allocation was at the end of a page, and the
>     next page was unallocated.
>     
>     The quick fix is to just change the order of the tests: check that there
>     is any iovec data left before we check the iov entry itself.
>     
>     Thanks to Alexey Dobriyan for finding this case, and testing the fix.
>     
>     Reported-and-tested-by: Alexey Dobriyan <adobriyan@...il.com>
>     Cc: Nick Piggin <npiggin@...e.de>
>     Cc: Andrew Morton <akpm@...ux-foundation.org>
>     Cc: <stable@...nel.org> [2.6.25.x, 2.6.26.x]
>     Signed-off-by: Linus Torvalds <torvalds@...ux-foundation.org>
> ---
>  mm/filemap.c |    2 +-
>  1 files changed, 1 insertions(+), 1 deletions(-)
> 
> diff --git a/mm/filemap.c b/mm/filemap.c
> index 42bbc69..d97d1ad 100644
> --- a/mm/filemap.c
> +++ b/mm/filemap.c
> @@ -1879,7 +1879,7 @@ void iov_iter_advance(struct iov_iter *i, size_t bytes)
>  		 * The !iov->iov_len check ensures we skip over unlikely
>  		 * zero-length segments (without overruning the iovec).
>  		 */
> -		while (bytes || unlikely(!iov->iov_len && i->count)) {
> +		while (bytes || unlikely(i->count && !iov->iov_len)) {
>  			int copy;
>  
>  			copy = min(bytes, iov->iov_len - base);

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/