lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
Open Source and information security mailing list archives
| ||
|
Date: Thu, 4 Feb 2010 11:58:01 +0900 From: KAMEZAWA Hiroyuki <kamezawa.hiroyu@...fujitsu.com> To: Wu Fengguang <fengguang.wu@...el.com> Cc: Greg KH <greg@...ah.com>, Andrew Morton <akpm@...ux-foundation.org>, Greg Kroah-Hartman <gregkh@...e.de>, LKML <linux-kernel@...r.kernel.org>, Linux Memory Management List <linux-mm@...ck.org>, Andi Kleen <andi@...stfloor.org>, "linux-fsdevel@...r.kernel.org" <linux-fsdevel@...r.kernel.org>, "stable@...nel.org" <stable@...nel.org>, juha_motorsportcom@...kku.com Subject: Re: [stable] [PATCH] devmem: check vmalloc address on kmem read/write On Thu, 4 Feb 2010 10:42:02 +0800 Wu Fengguang <fengguang.wu@...el.com> wrote: > From: KAMEZAWA Hiroyuki <kamezawa.hiroyu@...fujitsu.com> > > commit 325fda71d0badc1073dc59f12a948f24ff05796a upstream. > > Otherwise vmalloc_to_page() will BUG(). > > This also makes the kmem read/write implementation aligned with mem(4): > "References to nonexistent locations cause errors to be returned." Here > we return -ENXIO (inspired by Hugh) if no bytes have been transfered > to/from user space, otherwise return partial read/write results. > Wu-san, I have additonal fix to this patch. Now, *ppos update is unstable.. Could you make merged one ? Maybe this one makes the all behavior clearer. == This is a more fix for devmem-check-vmalloc-address-on-kmem-read-write.patch Now, the condition for updating *ppos is not good. (it's updated even if EFAULT occurs..). This fixes that. Reported-by: "Juha Leppanen" <juha_motorsportcom@...kku.com> CC: Wu Fengguang <fengguang.wu@...el.com> Signed-off-by: KAMEZAWA Hiroyuki <kamezawa.hiroyu@...fujitsu.com> --- drivers/char/mem.c | 34 +++++++++++++++++++++++++--------- 1 file changed, 25 insertions(+), 9 deletions(-) Index: mmotm-2.6.33-Feb01/drivers/char/mem.c =================================================================== --- mmotm-2.6.33-Feb01.orig/drivers/char/mem.c +++ mmotm-2.6.33-Feb01/drivers/char/mem.c @@ -460,14 +460,18 @@ static ssize_t read_kmem(struct file *fi } free_page((unsigned long)kbuf); } + /* EFAULT is always critical */ + if (err == -EFAULT) + return err; + if (err == -ENXIO && !read) + return -ENXIO; *ppos = p; - return read ? read : err; + return read; } static inline ssize_t -do_write_kmem(unsigned long p, const char __user *buf, - size_t count, loff_t *ppos) +do_write_kmem(unsigned long p, const char __user *buf, size_t count) { ssize_t written, sz; unsigned long copied; @@ -510,7 +514,6 @@ do_write_kmem(unsigned long p, const cha written += sz; } - *ppos += written; return written; } @@ -521,6 +524,7 @@ do_write_kmem(unsigned long p, const cha static ssize_t write_kmem(struct file * file, const char __user * buf, size_t count, loff_t *ppos) { + /* Kernel virtual memory never exceeds unsigned long */ unsigned long p = *ppos; ssize_t wrote = 0; ssize_t virtr = 0; @@ -530,7 +534,7 @@ static ssize_t write_kmem(struct file * if (p < (unsigned long) high_memory) { unsigned long to_write = min_t(unsigned long, count, (unsigned long)high_memory - p); - wrote = do_write_kmem(p, buf, to_write, ppos); + wrote = do_write_kmem(p, buf, to_write); if (wrote != to_write) return wrote; p += wrote; @@ -540,8 +544,13 @@ static ssize_t write_kmem(struct file * if (count > 0) { kbuf = (char *)__get_free_page(GFP_KERNEL); - if (!kbuf) - return wrote ? wrote : -ENOMEM; + if (!kbuf) { + if (wrote) { /* update ppos and return copied bytes */ + *ppos = p; + return wrote; + } else + return -ENOMEM; + } while (count > 0) { unsigned long sz = size_inside_page(p, count); unsigned long n; @@ -563,9 +572,16 @@ static ssize_t write_kmem(struct file * } free_page((unsigned long)kbuf); } - + /* EFAULT is always critical. */ + if (err == -EFAULT) + return err; + if (err == -ENXIO) { + /* We reached the end of vmalloc area..check real bug or not*/ + if (!(virtr + wrote)) /* nothing written */ + return -ENXIO; + } *ppos = p; - return virtr + wrote ? : err; + return virtr + wrote; } #endif -- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@...r.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/
Powered by blists - more mailing lists