linux-kernel - Re: [PATCH][next] mm/vmalloc: fix read of uninitialized pointer area

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date:   Mon, 22 Mar 2021 12:46:40 +1000
From:   Nicholas Piggin <npiggin@...il.com>
To:     Andrew Morton <akpm@...ux-foundation.org>,
        Colin King <colin.king@...onical.com>, linux-mm@...ck.org,
        Stephen Rothwell <sfr@...b.auug.org.au>
Cc:     kernel-janitors@...r.kernel.org, linux-kernel@...r.kernel.org
Subject: Re: [PATCH][next] mm/vmalloc: fix read of uninitialized pointer area

Excerpts from Colin King's message of March 19, 2021 1:59 am:
> From: Colin Ian King <colin.king@...onical.com>
> 
> There is a corner case where the sanity check of variable size fails
> and branches to label fail and shift can be less than PAGE_SHIFT
> causing area to never be assigned. This was picked up by static
> analysis as follows:
> 
>     1. var_decl: Declaring variable area without initializer.
>        struct vm_struct *area;
> 
>    ...
> 
>     2. Condition !size, taking true branch.
>        if (!size || (size >> PAGE_SHIFT) > totalram_pages())
>     3. Jumping to label fail.
>                goto fail;
> 
>     ...
> 
>     4. Condition shift > 12, taking false branch.
> 	fail:
> 		if (shift > PAGE_SHIFT) {
> 			shift = PAGE_SHIFT;
> 			align = real_align;
> 			size = real_size;
> 			goto again;
> 		}
> 
>      Uninitialized pointer read (UNINIT)
>      5. uninit_use: Using uninitialized value area.
>  		if (!area) {
> 			...
> 		}
> 
> Fix this by setting area to NULL to avoid the uninitialized read
> of area.
> 
> Addresses-Coverity: ("Uninitialized pointer read")
> Fixes: 92db9fec381b ("mm/vmalloc: hugepage vmalloc mappings")
> Signed-off-by: Colin Ian King <colin.king@...onical.com>

Looks good to me.

Acked-by: Nicholas Piggin <npiggin@...il.com>

Thanks,
Nick

> ---
>  mm/vmalloc.c | 4 +++-
>  1 file changed, 3 insertions(+), 1 deletion(-)
> 
> diff --git a/mm/vmalloc.c b/mm/vmalloc.c
> index 96444d64129a..4b415b4bb7ae 100644
> --- a/mm/vmalloc.c
> +++ b/mm/vmalloc.c
> @@ -2888,8 +2888,10 @@ void *__vmalloc_node_range(unsigned long size, unsigned long align,
>  	unsigned long real_align = align;
>  	unsigned int shift = PAGE_SHIFT;
>  
> -	if (!size || (size >> PAGE_SHIFT) > totalram_pages())
> +	if (!size || (size >> PAGE_SHIFT) > totalram_pages()) {
> +		area = NULL;
>  		goto fail;
> +	}
>  
>  	if (vmap_allow_huge && !(vm_flags & VM_NO_HUGE_VMAP) &&
>  			arch_vmap_pmd_supported(prot)) {
> -- 
> 2.30.2
> 
>