linux-kernel - [RFC PATCH] mm/highmem: VM_BUG_ON() if offset + len > PAGE

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Date:   Sun, 24 Apr 2022 12:48:06 +0200
From:   "Fabio M. De Francesco" <fmdefrancesco@...il.com>
To:     Ira Weiny <ira.weiny@...el.com>,
        Andrew Morton <akpm@...ux-foundation.org>,
        "Matthew Wilcox (Oracle)" <willy@...radead.org>,
        Catalin Marinas <catalin.marinas@....com>,
        Will Deacon <will@...nel.org>,
        Peter Collingbourne <pcc@...gle.com>,
        linux-kernel@...r.kernel.org
Cc:     "Fabio M. De Francesco" <fmdefrancesco@...il.com>
Subject: [RFC PATCH] mm/highmem: VM_BUG_ON() if offset + len > PAGE_SIZE

Call VM_BUG_ON() if offset + len > PAGE_SIZE.

This is an RFC patch because I'm not sure if we actually need to BUG_ON(),
so I'd like to know what Maintainers and other developers think about this
proposal.

Please note that memset_page() uses VM_BUG_ON() to prevent the same issue.

Furthermore, I also cannot understand why memset_page() does not call
flush_dcache_page() after memset() but I suppose that the different
implementations of these two functions should be addressed in another RFC.

Signed-off-by: Fabio M. De Francesco <fmdefrancesco@...il.com>
---
 include/linux/highmem.h | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/include/linux/highmem.h b/include/linux/highmem.h
index c3d562b5f0c1..bdb16d5f8148 100644
--- a/include/linux/highmem.h
+++ b/include/linux/highmem.h
@@ -349,6 +349,8 @@ static inline void memcpy_to_page(struct page *page, size_t offset,
 static inline void memzero_page(struct page *page, size_t offset, size_t len)
 {
 	char *addr = kmap_local_page(page);
+
+	VM_BUG_ON(offset + len > PAGE_SIZE);
 	memset(addr + offset, 0, len);
 	flush_dcache_page(page);
 	kunmap_local(addr);
-- 
2.34.1