lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
Open Source and information security mailing list archives
| ||
|
Date: Wed, 2 Jan 2019 14:32:54 -0500 From: Boris Ostrovsky <boris.ostrovsky@...cle.com> To: Souptick Joarder <jrdr.linux@...il.com>, Andrew Morton <akpm@...ux-foundation.org>, Matthew Wilcox <willy@...radead.org>, Michal Hocko <mhocko@...e.com>, Juergen Gross <jgross@...e.com>, Russell King - ARM Linux <linux@...linux.org.uk>, robin.murphy@....com Cc: xen-devel@...ts.xenproject.org, linux-kernel@...r.kernel.org, Linux-MM <linux-mm@...ck.org> Subject: Re: [PATCH v5 8/9] xen/gntdev.c: Convert to use vm_insert_range On 1/2/19 1:58 PM, Souptick Joarder wrote: > On Mon, Dec 24, 2018 at 6:53 PM Souptick Joarder <jrdr.linux@...il.com> wrote: >> Convert to use vm_insert_range() to map range of kernel >> memory to user vma. >> >> Signed-off-by: Souptick Joarder <jrdr.linux@...il.com> >> Reviewed-by: Matthew Wilcox <willy@...radead.org> >> Reviewed-by: Boris Ostrovsky <boris.ostrovsky@...cle.com> >> --- >> drivers/xen/gntdev.c | 11 ++++------- >> 1 file changed, 4 insertions(+), 7 deletions(-) >> >> diff --git a/drivers/xen/gntdev.c b/drivers/xen/gntdev.c >> index b0b02a5..430d4cb 100644 >> --- a/drivers/xen/gntdev.c >> +++ b/drivers/xen/gntdev.c >> @@ -1084,7 +1084,7 @@ static int gntdev_mmap(struct file *flip, struct vm_area_struct *vma) >> int index = vma->vm_pgoff; >> int count = vma_pages(vma); >> struct gntdev_grant_map *map; >> - int i, err = -EINVAL; >> + int err = -EINVAL; >> >> if ((vma->vm_flags & VM_WRITE) && !(vma->vm_flags & VM_SHARED)) >> return -EINVAL; >> @@ -1145,12 +1145,9 @@ static int gntdev_mmap(struct file *flip, struct vm_area_struct *vma) >> goto out_put_map; >> >> if (!use_ptemod) { >> - for (i = 0; i < count; i++) { >> - err = vm_insert_page(vma, vma->vm_start + i*PAGE_SIZE, >> - map->pages[i]); >> - if (err) >> - goto out_put_map; >> - } > Looking into the original code, the loop should run from i =0 to *i < > map->count*. > There is no error check for *count > map->count* and we might end up > overrun the map->pages[i] boundary. I don't think we can have map->count != count (see gntdev_find_map_index()). But for clarity I agree using map->count might be better. > > While converting this code with suggested vm_insert_range(), this can be fixed. And count can be dropped altogether. Thanks. -boris > > >> + err = vm_insert_range(vma, vma->vm_start, map->pages, count); >> + if (err) >> + goto out_put_map; >> } else { >> #ifdef CONFIG_X86 >> /* >> -- >> 1.9.1 >>
Powered by blists - more mailing lists