linux-kernel - [PATCH] asm/sections: Check for overflow in memory

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-Id: <20191217102238.14792-1-vincent.whitchurch@axis.com>
Date:   Tue, 17 Dec 2019 11:22:38 +0100
From:   Vincent Whitchurch <vincent.whitchurch@...s.com>
To:     akpm@...ux-foundation.org
Cc:     arnd@...db.de, treding@...dia.com,
        linux-arm-kernel@...ts.infradead.org, linux-kernel@...r.kernel.org,
        Vincent Whitchurch <rabinv@...s.com>
Subject: [PATCH] asm/sections: Check for overflow in memory_contains()

ARM uses memory_contains() from its stacktrace code via this function:

 static inline bool in_entry_text(unsigned long addr)
 {
 	return memory_contains(__entry_text_start, __entry_text_end,
 			       (void *)addr, 1);
 }

addr is taken from the stack and can be a completely invalid.  If addr
is 0xffffffff, there is an overflow in the pointer arithmetic in
memory_contains() and in_entry_text() incorrectly returns true.

Fix this by adding an overflow check.  The check is done on unsigned
longs to avoid undefined behaviour.

Signed-off-by: Vincent Whitchurch <vincent.whitchurch@...s.com>
---
 include/asm-generic/sections.h | 10 +++++++++-
 1 file changed, 9 insertions(+), 1 deletion(-)

diff --git a/include/asm-generic/sections.h b/include/asm-generic/sections.h
index d1779d442aa5..e6e1b381c5df 100644
--- a/include/asm-generic/sections.h
+++ b/include/asm-generic/sections.h
@@ -105,7 +105,15 @@ static inline int arch_is_kernel_initmem_freed(unsigned long addr)
 static inline bool memory_contains(void *begin, void *end, void *virt,
 				   size_t size)
 {
-	return virt >= begin && virt + size <= end;
+	unsigned long membegin = (unsigned long)begin;
+	unsigned long memend = (unsigned long)end;
+	unsigned long objbegin = (unsigned long)virt;
+	unsigned long objend = objbegin + size;
+
+	if (objend < objbegin)
+		return false;
+
+	return objbegin >= membegin && objend <= memend;
 }
 
 /**
-- 
2.20.0