linux-kernel - [PATCH v2] /dev/mem: Bail out upon SIGKILL.

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-Id: <1566533479-4390-1-git-send-email-penguin-kernel@I-love.SAKURA.ne.jp>
Date:   Fri, 23 Aug 2019 13:11:19 +0900
From:   Tetsuo Handa <penguin-kernel@...ove.SAKURA.ne.jp>
To:     Arnd Bergmann <arnd@...db.de>,
        Greg Kroah-Hartman <gregkh@...uxfoundation.org>
Cc:     linux-kernel@...r.kernel.org,
        Linus Torvalds <torvalds@...ux-foundation.org>,
        Tetsuo Handa <penguin-kernel@...ove.SAKURA.ne.jp>,
        syzbot <syzbot+8ab2d0f39fb79fe6ca40@...kaller.appspotmail.com>
Subject: [PATCH v2] /dev/mem: Bail out upon SIGKILL.

syzbot found that a thread can stall for minutes inside read_mem() or
write_mem() after that thread was killed by SIGKILL [1]. Reading 2GB at
one read() is legal, but delaying termination of killed thread for minutes
is bad. Let's insert cond_resched() and SIGKILL check into iteration loop
of reading/writing /dev/mem and /dev/kmem.

  [ 1335.912419][T20577] read_mem: sz=4096 count=2134565632
  [ 1335.943194][T20577] read_mem: sz=4096 count=2134561536
  [ 1335.978280][T20577] read_mem: sz=4096 count=2134557440
  [ 1336.011147][T20577] read_mem: sz=4096 count=2134553344
  [ 1336.041897][T20577] read_mem: sz=4096 count=2134549248

[1] https://syzkaller.appspot.com/bug?id=a0e3436829698d5824231251fad9d8e998f94f5e

Signed-off-by: Tetsuo Handa <penguin-kernel@...ove.SAKURA.ne.jp>
Reported-by: syzbot <syzbot+8ab2d0f39fb79fe6ca40@...kaller.appspotmail.com>
---
 drivers/char/mem.c | 23 +++++++++++++++++++++++
 1 file changed, 23 insertions(+)

diff --git a/drivers/char/mem.c b/drivers/char/mem.c
index b08dc50..cb8e653 100644
--- a/drivers/char/mem.c
+++ b/drivers/char/mem.c
@@ -140,6 +140,10 @@ static ssize_t read_mem(struct file *file, char __user *buf,
 		int allowed, probe;
 
 		sz = size_inside_page(p, count);
+		cond_resched();
+		err = -EINTR;
+		if (fatal_signal_pending(current))
+			goto failed;
 
 		err = -EPERM;
 		allowed = page_is_allowed(p >> PAGE_SHIFT);
@@ -218,6 +222,9 @@ static ssize_t write_mem(struct file *file, const char __user *buf,
 		int allowed;
 
 		sz = size_inside_page(p, count);
+		cond_resched();
+		if (fatal_signal_pending(current))
+			return -EINTR;
 
 		allowed = page_is_allowed(p >> PAGE_SHIFT);
 		if (!allowed)
@@ -451,6 +458,9 @@ static ssize_t read_kmem(struct file *file, char __user *buf,
 #endif
 		while (low_count > 0) {
 			sz = size_inside_page(p, low_count);
+			cond_resched();
+			if (fatal_signal_pending(current))
+				return -EINTR;
 
 			/*
 			 * On ia64 if a page has been mapped somewhere as
@@ -477,6 +487,11 @@ static ssize_t read_kmem(struct file *file, char __user *buf,
 			return -ENOMEM;
 		while (count > 0) {
 			sz = size_inside_page(p, count);
+			cond_resched();
+			if (fatal_signal_pending(current)) {
+				err = -EINTR;
+				break;
+			}
 			if (!is_vmalloc_or_module_addr((void *)p)) {
 				err = -ENXIO;
 				break;
@@ -523,6 +538,9 @@ static ssize_t do_write_kmem(unsigned long p, const char __user *buf,
 		void *ptr;
 
 		sz = size_inside_page(p, count);
+		cond_resched();
+		if (fatal_signal_pending(current))
+			return -EINTR;
 
 		/*
 		 * On ia64 if a page has been mapped somewhere as uncached, then
@@ -581,6 +599,11 @@ static ssize_t write_kmem(struct file *file, const char __user *buf,
 			unsigned long sz = size_inside_page(p, count);
 			unsigned long n;
 
+			cond_resched();
+			if (fatal_signal_pending(current)) {
+				err = -EINTR;
+				break;
+			}
 			if (!is_vmalloc_or_module_addr((void *)p)) {
 				err = -ENXIO;
 				break;
-- 
1.8.3.1