linux-kernel - Re: [PATCH] check mapped ranges on sysfs resource files (for 2.6.27)

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-Id: <200810021651.29081.jbarnes@virtuousgeek.org>
Date:	Thu, 2 Oct 2008 16:51:28 -0700
From:	Jesse Barnes <jbarnes@...tuousgeek.org>
To:	Linus Torvalds <torvalds@...ux-foundation.org>
Cc:	Linux Kernel Mailing List <linux-kernel@...r.kernel.org>,
	linux-pci@...r.kernel.org
Subject: Re: [PATCH] check mapped ranges on sysfs resource files (for 2.6.27)

On Thursday, October 2, 2008 4:30 pm Linus Torvalds wrote:
> On Thu, 2 Oct 2008, Jesse Barnes wrote:
> > +	unsigned long map_len = vma->vm_end - vma->vm_start;
> > +	unsigned long map_offset = vma->vm_pgoff << PAGE_SHIFT;
>
> This seems broken for big vm_pgoff values, where that shift will
> potentially overflow, no?

Ah yes, exactly what we want to be checking for in fact.

> Also, it strikes me that we don't seem to check that the resource start is
> page-aligned. We just do
>
> 	vma->vm_pgoff += start >> PAGE_SHIFT;
>
> without checking if we just dropped low bits from 'start'.

Hm, yeah looks like that's a long standing issue...

> Of course, if the length of the resource is bigger than a page, I guess
> the resource is guaranteed to be at least page-aligned, so maybe the
> length check - if it was correct - would be sufficient.
>
> Anyway, it would be *much* better to do the length check in pages rather
> than in bytes, to avoid the overflow condition.
>
> Can somebody test if something like this works? It also prints the actual
> name of the device, not just a random BAR number (but it will print
> everyting in PFN's, I hate potentially losing information).

Yeah, looks much better.  I was using this silly test program to see if the 
earlier code worked.  Just pass in both valid and invalid sizes.

Jesse

View attachment "sysfs-mmap-test.c" of type "text/x-csrc" (826 bytes)