linux-kernel - Re: [PATCH] pstore: fix incorrect persistent ram buffer mapping

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <CAGXu5j+C9pApyP4ab6usOudFFFBqX5WpZQYaH6m2BpmABB2W6w@mail.gmail.com>
Date:   Wed, 12 Sep 2018 10:44:54 -0700
From:   Kees Cook <keescook@...omium.org>
To:     Bin Yang <bin.yang@...el.com>
Cc:     Anton Vorontsov <anton@...msg.org>,
        Colin Cross <ccross@...roid.com>,
        Tony Luck <tony.luck@...el.com>,
        LKML <linux-kernel@...r.kernel.org>
Subject: Re: [PATCH] pstore: fix incorrect persistent ram buffer mapping

On Tue, Sep 11, 2018 at 8:36 PM, Bin Yang <bin.yang@...el.com> wrote:
> persistent_ram_vmap() returns the page start vaddr.
> persistent_ram_iomap() supports non-page-aligned mapping.

Oh, yes, good catch. This should probably be explicitly mentioned in
comments for these functions.

> persistent_ram_buffer_map() always adds offset-in-page to the vaddr
> returned from these two functions, which causes incorrect mapping of
> non-page-aligned persistent ram buffer.

How did you find this problem, and/or how was the problem manifesting?

> Signed-off-by: Bin Yang <bin.yang@...el.com>
> ---
>  fs/pstore/ram_core.c | 6 +++---
>  1 file changed, 3 insertions(+), 3 deletions(-)
>
> diff --git a/fs/pstore/ram_core.c b/fs/pstore/ram_core.c
> index 951a14e..7c05fdd 100644
> --- a/fs/pstore/ram_core.c
> +++ b/fs/pstore/ram_core.c
> @@ -429,7 +429,7 @@ static void *persistent_ram_vmap(phys_addr_t start, size_t size,
>         vaddr = vmap(pages, page_count, VM_MAP, prot);
>         kfree(pages);
>
> -       return vaddr;
> +       return vaddr + offset_in_page(start);
>  }
>
>  static void *persistent_ram_iomap(phys_addr_t start, size_t size,
> @@ -468,7 +468,7 @@ static int persistent_ram_buffer_map(phys_addr_t start, phys_addr_t size,
>                 return -ENOMEM;
>         }
>
> -       prz->buffer = prz->vaddr + offset_in_page(start);
> +       prz->buffer = prz->vaddr;
>         prz->buffer_size = size - sizeof(struct persistent_ram_buffer);
>
>         return 0;
> @@ -515,7 +515,7 @@ void persistent_ram_free(struct persistent_ram_zone *prz)
>
>         if (prz->vaddr) {
>                 if (pfn_valid(prz->paddr >> PAGE_SHIFT)) {
> -                       vunmap(prz->vaddr);
> +                       vunmap(prz->vaddr - offset_in_page(prz->paddr));
>                 } else {
>                         iounmap(prz->vaddr);
>                         release_mem_region(prz->paddr, prz->size);
> --
> 2.7.4
>

Regardless, yes, this patch looks correct. Thanks! I'll add it to my tree.

-Kees

-- 
Kees Cook
Pixel Security