linux-kernel - Re: [GIT PULL] MM updates for 6.3-rc1

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Sat, 25 Feb 2023 19:57:27 -0800
From:   Andrew Morton <akpm@...ux-foundation.org>
To:     Linus Torvalds <torvalds@...ux-foundation.org>
Cc:     "Liam R. Howlett" <Liam.Howlett@...cle.com>, linux-mm@...ck.org,
        mm-commits@...r.kernel.org, linux-kernel@...r.kernel.org
Subject: Re: [GIT PULL] MM updates for 6.3-rc1

On Sat, 25 Feb 2023 19:53:04 -0800 Linus Torvalds <torvalds@...ux-foundation.org> wrote:

> On Sat, Feb 25, 2023 at 7:27 PM Linus Torvalds
> <torvalds@...ux-foundation.org> wrote:
> >
> > Will bisect further, but adding Liam to the participants because it's
> > now narrowed down to his changes.
> 
> Ok, it's commit 2286a6914c77 ("mm: change mprotect_fixup to vma iterator")

Liam sent us a fix yesterday, hopefully this?


From: "Liam R. Howlett" <Liam.Howlett@...cle.com>
Subject: mm/mprotect: Fix successful vma_merge() of next in do_mprotect_pkey()
Date: Fri, 24 Feb 2023 16:20:55 -0500

If mprotect_fixup() successfully calls vma_merge() and replaces vma and
the next vma, then the tmp variable in the do_mprotect_pkey() is not
updated to point to the new vma end.  This results in the loop detecting a
gap between VMAs that does not exist.  Fix the faulty value of tmp by
setting it to the end location of the vma iterator at the end of the loop.

Link: https://lkml.kernel.org/r/20230224212055.1786100-1-Liam.Howlett@oracle.com
Fixes: 2286a6914c77 ("mm: change mprotect_fixup to vma iterator")
Link: https://lore.kernel.org/linux-mm/20230223120407.729110a6ecd1416ac59d9cb0@linux-foundation.org/
Signed-off-by: Liam R. Howlett <Liam.Howlett@...cle.com>
Reported-by: Bert Karwatzki <spasswolf@....de>
  Link: https://bugzilla.kernel.org/show_bug.cgi?id=217061
Tested-by: Bert Karwatzki <spasswolf@....de>
Signed-off-by: Andrew Morton <akpm@...ux-foundation.org>
---


--- a/mm/mprotect.c~mm-mprotect-fix-successful-vma_merge-of-next-in-do_mprotect_pkey
+++ b/mm/mprotect.c
@@ -832,6 +832,7 @@ static int do_mprotect_pkey(unsigned long start, size_t len,
 		if (error)
 			break;
 
+		tmp = vma_iter_end(&vmi);
 		nstart = tmp;
 		prot = reqprot;
 	}
_