linux-kernel - Re: mmap for /proc/vmcore broken since 3.12-rc1

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <525B7898.6010802@jp.fujitsu.com>
Date:	Mon, 14 Oct 2013 13:52:40 +0900
From:	HATAYAMA Daisuke <d.hatayama@...fujitsu.com>
To:	Alexey Dobriyan <adobriyan@...il.com>
CC:	Michael Holzheu <holzheu@...ux.vnet.ibm.com>,
	"David S. Miller" <davem@...emloft.net>,
	Vivek Goyal <vgoyal@...hat.com>,
	Jan Willeke <willeke@...ibm.com>,
	Linux Kernel <linux-kernel@...r.kernel.org>,
	kexec@...ts.infradead.org
Subject: Re: mmap for /proc/vmcore broken since 3.12-rc1

(2013/10/13 5:32), Alexey Dobriyan wrote:
> On Wed, Oct 09, 2013 at 07:14:55PM +0900, HATAYAMA Daisuke wrote:
>> Hello,
>>
>> (2013/10/08 21:49), Alexey Dobriyan wrote:
>>> On Mon, Oct 7, 2013 at 5:42 AM, HATAYAMA Daisuke
>>> <d.hatayama@...fujitsu.com> wrote:
>>>
>>>> +static unsigned long
>>>> +get_unmapped_area_vmcore(struct file *filp, unsigned long addr,
>>>> +                        unsigned long len, unsigned long pgoff,
>>>> +                        unsigned long flags)
>>>> +{
>>>> +#ifdef CONFIG_MMU
>>>> +       return current->mm->get_unmapped_area(filp, addr, len, pgoff,
>>>> flags);
>>>> +#else
>>>> +       return -EIO;
>>>> +#endif
>>>> +}
>>>> +
>>>>    static const struct file_operations proc_vmcore_operations = {
>>>>           .read           = read_vmcore,
>>>>           .llseek         = default_llseek,
>>>>           .mmap           = mmap_vmcore,
>>>> +       .get_unmapped_area = get_unmapped_area_vmcore,
>>>
>>> I think current->mm->get_unmapped_area should be used by core proc code.
>>
>> What do you actually suggest here? You mean moving this code in proc code?
>> I don't think you suggest so.
>
> Please, try this patch, I don't have kexec setup handy.
>
> --- a/fs/proc/inode.c
> +++ b/fs/proc/inode.c
> @@ -291,7 +291,11 @@ static unsigned long proc_reg_get_unmapped_area(struct file *file, unsigned long
>   	int rv = -EIO;
>   	unsigned long (*get_unmapped_area)(struct file *, unsigned long, unsigned long, unsigned long, unsigned long);
>   	if (use_pde(pde)) {
> -		get_unmapped_area = pde->proc_fops->get_unmapped_area;
> +		get_unmapped_area = current->mm->get_unmapped_area;
> +#ifdef CONFIG_MMU
> +		if (pde->proc_fops->get_unmapped_area)
> +			get_unmapped_area = pde->proc_fops->get_unmapped_area;
> +#endif
>   		if (get_unmapped_area)
>   			rv = get_unmapped_area(file, orig_addr, len, pgoff, flags);
>   		unuse_pde(pde);
>

Slight modification to #ifdef ...

get_unmapped_area = NULL;
#ifdef CONFIG_MMU
get_unmapped_area = current->mm->get_unmapped_area
#endif
if (pde->proc_fops->get_unmapped_area)
   get_unmapped_area = pde->proc_fops->get_unmapped_area;

And, I found the bug. The variable rv should have been defined as unsigned
long. sizeof(int) is 4 bytes but sizeof(long) is 8 bytes at least on x86_64.

The reason why returned value looked like kernel virtual address was due to
signed extension performed during conversion from negative 32-bit signed
integer to 64-bit unsigned long integer.

Hmm, I first checked signature of related functions but overlooked...

Anyway, I'll post fixing patch soon.

-- 
Thanks.
HATAYAMA, Daisuke

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/