linux-kernel - Re: [PATCH] kexec: segmentation fault in kimage_add_entry

Open Source and information security mailing list archives

Message-ID: <20080918043018.GD32516@verge.net.au>
Date:	Thu, 18 Sep 2008 14:30:19 +1000
From:	Simon Horman <horms@...ge.net.au>
To:	"Eric W. Biederman" <ebiederm@...ssion.com>
Cc:	Andrew Morton <akpm@...ux-foundation.org>,
	Linus Torvalds <torvalds@...ux-foundation.org>,
	Jonathan Steel <jon.steel@...ntire.com>,
	kexec@...ts.infradead.org, linux-kernel@...r.kernel.org
Subject: Re: [PATCH] kexec: segmentation fault in kimage_add_entry

On Tue, Sep 16, 2008 at 03:21:53PM -0700, Eric W. Biederman wrote:
> From: Jonathan Steel <jon.steel@...ntire.com>
> 
> A segmentation fault can occur in kimage_add_entry in kexec.c when
> loading a kernel image into memory. The fault occurs because a page is
> requested by calling kimage_alloc_page with gfp_mask GFP_KERNEL and the
> function may actually return a page with gfp_mask GFP_HIGHUSER. The high
> mem page is returned because it was swapped with the kernel page due to
> the kernel page being a page that will shortly be copied to.
> 
> This patch ensures that kimage_alloc_page returns a page that was
> created with the correct gfp flags.
> 
> 
> I have verified the change and fixed the whitespace damage of the
> original patch.  Jonathan did a great job of tracking this down
> after he hit the problem. -- Eric
> 
> Signed-off-by: Jonathan Steel <jon.steel@...ntire.com>
> Signed-off-by: Eric W. Biederman <ebiederm@...ssion.com>

For what it is worth: Acked-by: Simon Horman <horms@...ge.net.au>

> ---
>  kernel/kexec.c |    8 +++++++-
>  1 files changed, 7 insertions(+), 1 deletions(-)
> 
> diff --git a/kernel/kexec.c b/kernel/kexec.c
> index 59f3f0d..aef2653 100644
> --- a/kernel/kexec.c
> +++ b/kernel/kexec.c
> @@ -753,8 +753,14 @@ static struct page *kimage_alloc_page(struct kimage *image,
>  			*old = addr | (*old & ~PAGE_MASK);
>  
>  			/* The old page I have found cannot be a
> -			 * destination page, so return it.
> +			 * destination page, so return it if it's
> +			 * gfp_flags honor the ones passed in.
>  			 */
> +			if (!(gfp_mask & __GFP_HIGHMEM) &&
> +			    PageHighMem(old_page)) {
> +				kimage_free_pages(old_page);
> +				continue;
> +			}
>  			addr = old_addr;
>  			page = old_page;
>  			break;
> -- 
> 1.5.3.rc6.17.g1911
> 
> 
> _______________________________________________
> kexec mailing list
> kexec@...ts.infradead.org
> http://lists.infradead.org/mailman/listinfo/kexec

-- 
Simon Horman
  VA Linux Systems Japan K.K., Sydney, Australia Satellite Office
  H: www.vergenet.net/~horms/             W: www.valinux.co.jp/en

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives