linux-kernel - Re: [PATCH v2 3/7] mm/gup: remove vmas parameter from get_user_pages

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <63d92734-2185-439c-bbc7-53a4720f5d4a@lucifer.local>
Date:   Sat, 15 Apr 2023 11:14:08 +0100
From:   Lorenzo Stoakes <lstoakes@...il.com>
To:     Tetsuo Handa <penguin-kernel@...ove.sakura.ne.jp>
Cc:     Andrew Morton <akpm@...ux-foundation.org>, linux-mm@...ck.org,
        linux-kernel@...r.kernel.org
Subject: Re: [PATCH v2 3/7] mm/gup: remove vmas parameter from
 get_user_pages_remote()

On Sat, Apr 15, 2023 at 06:52:41PM +0900, Tetsuo Handa wrote:
> On 2023/04/15 18:08, Lorenzo Stoakes wrote:
> > @@ -475,10 +474,14 @@ int uprobe_write_opcode(struct arch_uprobe *auprobe, struct mm_struct *mm,
> >  		gup_flags |= FOLL_SPLIT_PMD;
> >  	/* Read the page with vaddr into memory */
> >  	ret = get_user_pages_remote(mm, vaddr, 1, gup_flags,
> > -				    &old_page, &vma, NULL);
> > +				    &old_page, NULL);
> >  	if (ret <= 0)
> >  		return ret;
> >
> > +	vma = vma_lookup(mm, vaddr);
> > +	if (!vma)
> > +		goto put_old;
> > +
> >  	ret = verify_opcode(old_page, vaddr, &opcode);
> >  	if (ret <= 0)
> >  		goto put_old;
>
> This conversion looks wrong.
> This causes returning a positive number when vma_lookup() returned NULL.
>
>   * Return 0 (success) or a negative errno.
>

In reality it shouldn't be possible for vma to return NULL, I'm adding the
checks to be extra careful.

In any case you're right, attaching a -fix patch to avoid spam:-

----8<----
>From 0710d01ea69ad4e846fa1e56a40b253ff59714ac Mon Sep 17 00:00:00 2001
From: Lorenzo Stoakes <lstoakes@...il.com>
Date: Sat, 15 Apr 2023 11:09:15 +0100
Subject: [PATCH] mm/gup: remove vmas parameter from get_user_pages_remote()

Correct vma NULL check as indicated by Tetsuo.

Signed-off-by: Lorenzo Stoakes <lstoakes@...il.com>
---
 kernel/events/uprobes.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/kernel/events/uprobes.c b/kernel/events/uprobes.c
index b21993cd2dcc..affe42a13eff 100644
--- a/kernel/events/uprobes.c
+++ b/kernel/events/uprobes.c
@@ -479,8 +479,10 @@ int uprobe_write_opcode(struct arch_uprobe *auprobe, struct mm_struct *mm,
 		return ret;
 
 	vma = vma_lookup(mm, vaddr);
-	if (!vma)
+	if (!vma) {
+		ret = -EINVAL;
 		goto put_old;
+	}
 
 	ret = verify_opcode(old_page, vaddr, &opcode);
 	if (ret <= 0)
-- 
2.40.0