linux-kernel - Re: [PATCH] mm: Fix overflow check in expand

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <747944b6-ffb8-14db-d574-efc03e11f2a5@gmx.de>
Date:   Fri, 30 Jun 2017 08:57:27 +0200
From:   Helge Deller <deller@....de>
To:     Jörn Engel <joern@...estorage.com>,
        Hugh Dickins <hughd@...gle.com>, linux-kernel@...r.kernel.org
Subject: Re: [PATCH] mm: Fix overflow check in expand_upwards()

On 30.06.2017 01:02, Jörn Engel wrote:
> I believe the overflow check was correct, then got subtly broken by
> 	commit bd726c90b6b8
> 	Author: Helge Deller <deller@....de>
> 	Date:   Mon Jun 19 17:34:05 2017 +0200
> 
> 	    Allow stack to grow up to address space limit
> 
> The old overflow check may have been a bit subtle and I suppose Helge
> missed its importance.
> 
> 	if (!address)
> 		return -ENOMEM;
> 
> Functionally the my check is identical to the old one.  I just hope the
> alternative form (and comment!) make it harder to miss and break things
> in a future patch.
> 
> Signed-off-by: Joern Engel <joern@...fs.org>
> ---
>  mm/mmap.c | 3 ++-
>  1 file changed, 2 insertions(+), 1 deletion(-)
> 
> diff --git a/mm/mmap.c b/mm/mmap.c
> index a5e3dcd75e79..7366f62c31f4 100644
> --- a/mm/mmap.c
> +++ b/mm/mmap.c
> @@ -2232,7 +2232,8 @@ int expand_upwards(struct vm_area_struct *vma, unsigned long address)
>  
>  	/* Guard against exceeding limits of the address space. */
>  	address &= PAGE_MASK;
> -	if (address >= TASK_SIZE)
> +	/* second check is for integer overflow */
> +	if (address >= TASK_SIZE || address + PAGE_SIZE < address)
>  		return -ENOMEM;
>  	address += PAGE_SIZE;

That overflow check is still there.
Look at the next few lines in mmap.c:

       /* Enforce stack_guard_gap */
        gap_addr = address + stack_guard_gap;

        /* Guard against overflow */
        if (gap_addr < address || gap_addr > TASK_SIZE)
                gap_addr = TASK_SIZE;

If the requested page plus the gap (=gap_addr) wraps around, then the
code will limit it to TASK_SIZE.
So, the code should already take care of all possible areas >=TASK_SIZE,
including wrap-arounds.

Did you faced a real issue?

Helge