linux-kernel - [PATCH 0/2] mm: mremap: fix sign for EFAULT error return value

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-Id: <20220427224439.23828-1-dossche.niels@gmail.com>
Date:   Thu, 28 Apr 2022 00:44:37 +0200
From:   Niels Dossche <dossche.niels@...il.com>
To:     Andrew Morton <akpm@...ux-foundation.org>
Cc:     linux-mm@...ck.org, linux-kernel@...r.kernel.org,
        Mina Almasry <almasrymina@...gle.com>,
        Niels Dossche <dossche.niels@...il.com>
Subject: [PATCH 0/2] mm: mremap: fix sign for EFAULT error return value

The mremap syscall is supposed to return a pointer to the new virtual
memory area on success, and a negative value of the error code in case
of failure. Currently, EFAULT is returned when the VMA is not found,
instead of -EFAULT. The users of this syscall will therefore believe
the syscall succeeded in case the VMA didn't exist, as it returns a
pointer to address 0xe (0xe being the value of EFAULT).

This can easily be reproduced by the following C program. I expected
mremap to fail, but it does not. If the bug is present, it will print
0xe, otherwise the mremap will fail.

The patchset contains two patches: one that fixes the error, and
one that adds a small test case.

#define _GNU_SOURCE
#include <sys/mman.h>
#include <stdio.h>
int main() {
	// Get pointer that's definitely not mapped
	void* ptr = mmap(NULL, 4096, PROT_READ, MAP_PRIVATE | MAP_ANONYMOUS, -1, 0);
	if (ptr == MAP_FAILED) { perror("mmap"); return 1; }
	int err = munmap(ptr, 4096);
	if (err < 0) { perror("munmap"); return 1; }
	// Remap unexisting VMA
	ptr = mremap(ptr, 4096, 4096, 0);
	if (ptr == MAP_FAILED) { perror("mremap"); return 1; }
	printf("%p\n", ptr);
	return 0;
}

Niels Dossche (2):
  mm: mremap: fix sign for EFAULT error return value
  selftest/vm: test that mremap fails on non-existent vma

 mm/mremap.c                                  | 2 +-
 tools/testing/selftests/vm/hugepage-mremap.c | 6 ++++++
 2 files changed, 7 insertions(+), 1 deletion(-)

-- 
2.35.2