linux-kernel - [PATCH 1/1] mm: pagemap: limit scan to virtual region being asked

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-Id: <1421152024-6204-1-git-send-email-shashim@codeaurora.org>
Date:	Tue, 13 Jan 2015 17:57:04 +0530
From:	Shiraz Hashim <shashim@...eaurora.org>
To:	linux-mm@...ck.org
Cc:	akpm@...ux-foundation.org, oleg@...hat.com, gorcunov@...nvz.org,
	linux-kernel@...r.kernel.org,
	Shiraz Hashim <shashim@...eaurora.org>
Subject: [PATCH 1/1] mm: pagemap: limit scan to virtual region being asked

pagemap_read scans through the virtual address space of a
task till it prepares 'count' pagemaps or it reaches end
of task.

This presents a problem when the page walk doesn't happen
for vma with VM_PFNMAP set. In which case walk is silently
skipped and no pagemap is prepare, in turn making
pagemap_read to scan through task end, even crossing beyond
'count', landing into a different vma region. This leads to
wrong presentation of mappings for that vma.

Fix this by limiting end_vaddr to the end of the virtual
address region being scanned.

Signed-off-by: Shiraz Hashim <shashim@...eaurora.org>
---
 fs/proc/task_mmu.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/fs/proc/task_mmu.c b/fs/proc/task_mmu.c
index 246eae8..04362e4 100644
--- a/fs/proc/task_mmu.c
+++ b/fs/proc/task_mmu.c
@@ -1270,7 +1270,9 @@ static ssize_t pagemap_read(struct file *file, char __user *buf,
 	src = *ppos;
 	svpfn = src / PM_ENTRY_BYTES;
 	start_vaddr = svpfn << PAGE_SHIFT;
-	end_vaddr = TASK_SIZE_OF(task);
+	end_vaddr = start_vaddr + ((count / PM_ENTRY_BYTES) << PAGE_SHIFT);
+	if ((end_vaddr > TASK_SIZE_OF(task)) || (end_vaddr < start_vaddr))
+		end_vaddr = TASK_SIZE_OF(task);

 	/* watch out for wraparound */
 	if (svpfn > TASK_SIZE_OF(task) >> PAGE_SHIFT)
-- 

QUALCOMM INDIA, on behalf of Qualcomm Innovation Center, Inc. is a
member of the Code Aurora Forum, hosted by The Linux Foundation

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/