[<prev] [next>] [<thread-prev] [day] [month] [year] [list]
Message-ID: <20200923042605.GG3421308@ZenIV.linux.org.uk>
Date: Wed, 23 Sep 2020 05:26:05 +0100
From: Al Viro <viro@...iv.linux.org.uk>
To: Rasmus Villemoes <linux@...musvillemoes.dk>
Cc: Andy Lutomirski <luto@...nel.org>,
syzbot <syzbot+ea3a78a71705faf41d77@...kaller.appspotmail.com>,
Aleksa Sarai <cyphar@...har.com>,
Borislav Petkov <bp@...en8.de>,
Dave Hansen <dave.hansen@...ux.intel.com>,
"H. Peter Anvin" <hpa@...or.com>,
LKML <linux-kernel@...r.kernel.org>,
Ingo Molnar <mingo@...hat.com>,
Peter Zijlstra <peterz@...radead.org>,
syzkaller-bugs@...glegroups.com,
Thomas Gleixner <tglx@...utronix.de>, X86 ML <x86@...nel.org>
Subject: Re: WARNING in ex_handler_uaccess
On Mon, Sep 21, 2020 at 12:22:19PM +0200, Rasmus Villemoes wrote:
> So, not sure how the above got triggered, but I notice there might be an
> edge case in check_zeroed_user():
>
> from -= align;
> size += align;
>
> if (!user_read_access_begin(from, size))
> return -EFAULT;
>
> unsafe_get_user(val, (unsigned long __user *) from, err_fault);
>
>
> Suppose size is (size_t)-3 and align is 3. What's the convention for
> access_ok(whatever, 0)? Is that equivalent to access_ok(whatever, 1), or
> is it always true (or $ARCH-dependent)?
It's usually true...
> But, AFAICT, no current caller of check_zeroed_user can end up passing
> in a size that can overflow to 0. E.g. for the case at hand, size cannot
> be more than SIZE_MAX-24.
Might be worth slapping if (unlikely(!size)) return -EFAULT; // overflow
just before user_read_access_begin() to be sure...
Powered by blists - more mailing lists