linux-kernel - [PATCH] Fix zero_user_segments() with start

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <87eeh2erm0.fsf@mail.parknet.co.jp>
Date:   Sat, 27 Feb 2021 01:11:35 +0900
From:   OGAWA Hirofumi <hirofumi@...l.parknet.co.jp>
To:     linux-mm@...ck.org
Cc:     linux-kernel@...r.kernel.org,
        Andrew Morton <akpm@...ux-foundation.org>,
        Matthew Wilcox (Oracle) <willy@...radead.org>
Subject: [PATCH] Fix zero_user_segments() with start > end


zero_user_segments() is used from __block_write_begin_int(), for
example like the following

	zero_user_segments(page, 4096, 1024, 512, 918)

But new zero_user_segments() implements for HIGMEM + TRANSPARENT_HUGEPAGE 
doesn't handle "start > end" case correctly, and hits BUG_ON(). (we
can fix __block_write_begin_int() instead though, it is the old and
multiple usage)

Also it calls kmap_atomic() unnecessary while start == end == 0.

Cc: <stable@...r.kernel.org>
Signed-off-by: OGAWA Hirofumi <hirofumi@...l.parknet.co.jp>
---
 mm/highmem.c |   17 ++++++++++++-----
 1 file changed, 12 insertions(+), 5 deletions(-)

diff --git a/mm/highmem.c b/mm/highmem.c
index 874b732..86f2b94 100644
--- a/mm/highmem.c	2021-02-20 12:56:49.037165666 +0900
+++ b/mm/highmem.c	2021-02-20 22:03:08.369361223 +0900
@@ -368,20 +368,24 @@ void zero_user_segments(struct page *pag
 
 	BUG_ON(end1 > page_size(page) || end2 > page_size(page));
 
+	if (start1 >= end1)
+		start1 = end1 = 0;
+	if (start2 >= end2)
+		start2 = end2 = 0;
+
 	for (i = 0; i < compound_nr(page); i++) {
 		void *kaddr = NULL;
 
-		if (start1 < PAGE_SIZE || start2 < PAGE_SIZE)
-			kaddr = kmap_atomic(page + i);
-
 		if (start1 >= PAGE_SIZE) {
 			start1 -= PAGE_SIZE;
 			end1 -= PAGE_SIZE;
 		} else {
 			unsigned this_end = min_t(unsigned, end1, PAGE_SIZE);
 
-			if (end1 > start1)
+			if (end1 > start1) {
+				kaddr = kmap_atomic(page + i);
 				memset(kaddr + start1, 0, this_end - start1);
+			}
 			end1 -= this_end;
 			start1 = 0;
 		}
@@ -392,8 +396,11 @@ void zero_user_segments(struct page *pag
 		} else {
 			unsigned this_end = min_t(unsigned, end2, PAGE_SIZE);
 
-			if (end2 > start2)
+			if (end2 > start2) {
+				if (!kaddr)
+					kaddr = kmap_atomic(page + i);
 				memset(kaddr + start2, 0, this_end - start2);
+			}
 			end2 -= this_end;
 			start2 = 0;
 		}
_

-- 
OGAWA Hirofumi <hirofumi@...l.parknet.co.jp>