linux-kernel - Re: [PATCH] mm/gup: Remove some BUG_ONs from get_gate

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <201906270853.CB6DA7BC8@keescook>
Date:   Thu, 27 Jun 2019 08:53:26 -0700
From:   Kees Cook <keescook@...omium.org>
To:     Andy Lutomirski <luto@...nel.org>
Cc:     LKML <linux-kernel@...r.kernel.org>, Linux-MM <linux-mm@...ck.org>,
        Andrew Morton <akpm@...ux-foundation.org>, x86@...nel.org,
        Florian Weimer <fweimer@...hat.com>,
        Jann Horn <jannh@...gle.com>
Subject: Re: [PATCH] mm/gup: Remove some BUG_ONs from get_gate_page()

On Wed, Jun 26, 2019 at 09:47:30PM -0700, Andy Lutomirski wrote:
> If we end up without a PGD or PUD entry backing the gate area, don't
> BUG -- just fail gracefully.
> 
> It's not entirely implausible that this could happen some day on
> x86.  It doesn't right now even with an execute-only emulated
> vsyscall page because the fixmap shares the PUD, but the core mm
> code shouldn't rely on that particular detail to avoid OOPSing.
> 
> Signed-off-by: Andy Lutomirski <luto@...nel.org>

Reviewed-by: Kees Cook <keescook@...omium.org>

-Kees

> ---
>  mm/gup.c | 9 ++++++---
>  1 file changed, 6 insertions(+), 3 deletions(-)
> 
> diff --git a/mm/gup.c b/mm/gup.c
> index ddde097cf9e4..9883b598fd6f 100644
> --- a/mm/gup.c
> +++ b/mm/gup.c
> @@ -585,11 +585,14 @@ static int get_gate_page(struct mm_struct *mm, unsigned long address,
>  		pgd = pgd_offset_k(address);
>  	else
>  		pgd = pgd_offset_gate(mm, address);
> -	BUG_ON(pgd_none(*pgd));
> +	if (pgd_none(*pgd))
> +		return -EFAULT;
>  	p4d = p4d_offset(pgd, address);
> -	BUG_ON(p4d_none(*p4d));
> +	if (p4d_none(*p4d))
> +		return -EFAULT;
>  	pud = pud_offset(p4d, address);
> -	BUG_ON(pud_none(*pud));
> +	if (pud_none(*pud))
> +		return -EFAULT;
>  	pmd = pmd_offset(pud, address);
>  	if (!pmd_present(*pmd))
>  		return -EFAULT;
> -- 
> 2.21.0
> 

-- 
Kees Cook