linux-kernel - Re: [PATCH] mm/mprotect: Fix successful vma_merge() of next in do_mprotect

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date:   Fri, 24 Feb 2023 23:53:57 +0100
From:   Bert Karwatzki <spasswolf@....de>
To:     "Liam R. Howlett" <Liam.Howlett@...cle.com>,
        maple-tree@...ts.infradead.org, linux-mm@...ck.org,
        linux-kernel@...r.kernel.org,
        Andrew Morton <akpm@...ux-foundation.org>,
        linux-next@...r.kernel.org
Subject: Re: [PATCH] mm/mprotect: Fix successful vma_merge() of next in
 do_mprotect_pkey()

Am Freitag, dem 24.02.2023 um 16:20 -0500 schrieb Liam R. Howlett:
> If mprotect_fixup() successfully calls vma_merge() and replaces vma
> and
> the next vma, then the tmp variable in the do_mprotect_pkey() is not
> updated to point to the new vma end.  This results in the loop
> detecting
> a gap between VMAs that does not exist.  Fix the faulty value of tmp
> by
> setting it to the end location of the vma iterator at the end of the
> loop.
> 
> Reported-by: Bert Karwatzki <spasswolf@....de>
> Bug: https://bugzilla.kernel.org/show_bug.cgi?id=217061
> Fixes: 2286a6914c77 ("mm: change mprotect_fixup to vma iterator")
> Link:
> https://lore.kernel.org/linux-mm/20230223120407.729110a6ecd1416ac59d9cb0@linux-foundation.org/
> Signed-off-by: Liam R. Howlett <Liam.Howlett@...cle.com>
> ---
>  mm/mprotect.c | 1 +
>  1 file changed, 1 insertion(+)
> 
> diff --git a/mm/mprotect.c b/mm/mprotect.c
> index 1d4843c97c2a..231929f119d9 100644
> --- a/mm/mprotect.c
> +++ b/mm/mprotect.c
> @@ -832,6 +832,7 @@ static int do_mprotect_pkey(unsigned long start,
> size_t len,
>                 if (error)
>                         break;
>  
> +               tmp = vma_iter_end(&vmi);
>                 nstart = tmp;
>                 prot = reqprot;
>         }
I tested this in linux-next-20230224 by starting stellaris from steam
(which is the only way I managed to trigger the bug) and it fixes the
issue for me.
Bert Karwatzki