linux-kernel - Re: [v1] iov_iter: fix page_copy

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date:   Sat, 30 Sep 2017 13:51:17 -0700
From:   Eric Dumazet <edumazet@...gle.com>
To:     Thiago Macieira <thiago.macieira@...el.com>
Cc:     LKML <linux-kernel@...r.kernel.org>,
        Al Viro <viro@...iv.linux.org.uk>,
        Petar Penkov <peterpenkov96@...il.com>
Subject: Re: [v1] iov_iter: fix page_copy_sane for compound pages

On Sat, Sep 30, 2017 at 12:24 PM, Thiago Macieira
<thiago.macieira@...el.com> wrote:
> On Tuesday, 29 August 2017 11:20:32 PDT Petar Penkov wrote:
>> Issue is that if the data crosses a page boundary inside a compound
>> page, this check will incorrectly trigger a WARN_ON.
>>
>> To fix this, compute the order using the head of the compound page and
>> adjust the offset to be relative to that head.
>>
>> Fixes: 72e809ed81ed ("iov_iter: sanity checks for copy to/from page
>> primitives")
>
> Hello
>
> Is this patch slated to end up in one of the 4.13.x updates? It landed on
> v4.14-rc2 already but seems to have missed the 4.13.3 and 4.13.4 tagging.
>
> Without this patch, I can't connect any USB Ethernet or the kernel will start
> producing that WARN_ON message and returning -EFAULT for quite a few programs.
>

Hmm... problem Petar had originally has been solved.

His commit ( 90e33d45940793def6f773b2d528e9f3c84ffdc7 in Dave Miller net-next)
no longer hits the problem, while his prior version triggered the issue.

Relevant and updated part is :

+               page = virt_to_head_page(data);
+               offset = data - page_address(page);
+               skb_fill_page_desc(skb, i - 1, page, offset, fragsz);