Commit 3955333d authored by Laura Abbott's avatar Laura Abbott Committed by Linus Torvalds

proc/kcore: don't bounds check against address 0

The existing kcore code checks for bad addresses against __va(0) with
the assumption that this is the lowest address on the system.  This may
not hold true on some systems (e.g.  arm64) and produce overflows and
crashes.  Switch to using other functions to validate the address range.

It's currently only seen on arm64 and it's not clear if anyone wants to
use that particular combination on a stable release.  So this is not
urgent for stable.

Link: http://lkml.kernel.org/r/20180501201143.15121-1-labbott@redhat.comSigned-off-by: default avatarLaura Abbott <labbott@redhat.com>
Tested-by: default avatarDave Anderson <anderson@redhat.com>
Cc: Kees Cook <keescook@chromium.org>
Cc: Ard Biesheuvel <ard.biesheuvel@linaro.org>
Cc: Ingo Molnar <mingo@kernel.org>
Cc: Andi Kleen <andi@firstfloor.org>
Cc: Alexey Dobriyan <adobriyan@gmail.com>a
Signed-off-by: default avatarAndrew Morton <akpm@linux-foundation.org>
Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
parent 7aaf7727
...@@ -209,25 +209,34 @@ kclist_add_private(unsigned long pfn, unsigned long nr_pages, void *arg) ...@@ -209,25 +209,34 @@ kclist_add_private(unsigned long pfn, unsigned long nr_pages, void *arg)
{ {
struct list_head *head = (struct list_head *)arg; struct list_head *head = (struct list_head *)arg;
struct kcore_list *ent; struct kcore_list *ent;
struct page *p;
if (!pfn_valid(pfn))
return 1;
p = pfn_to_page(pfn);
if (!memmap_valid_within(pfn, p, page_zone(p)))
return 1;
ent = kmalloc(sizeof(*ent), GFP_KERNEL); ent = kmalloc(sizeof(*ent), GFP_KERNEL);
if (!ent) if (!ent)
return -ENOMEM; return -ENOMEM;
ent->addr = (unsigned long)__va((pfn << PAGE_SHIFT)); ent->addr = (unsigned long)page_to_virt(p);
ent->size = nr_pages << PAGE_SHIFT; ent->size = nr_pages << PAGE_SHIFT;
/* Sanity check: Can happen in 32bit arch...maybe */ if (!virt_addr_valid(ent->addr))
if (ent->addr < (unsigned long) __va(0))
goto free_out; goto free_out;
/* cut not-mapped area. ....from ppc-32 code. */ /* cut not-mapped area. ....from ppc-32 code. */
if (ULONG_MAX - ent->addr < ent->size) if (ULONG_MAX - ent->addr < ent->size)
ent->size = ULONG_MAX - ent->addr; ent->size = ULONG_MAX - ent->addr;
/* cut when vmalloc() area is higher than direct-map area */ /*
if (VMALLOC_START > (unsigned long)__va(0)) { * We've already checked virt_addr_valid so we know this address
if (ent->addr > VMALLOC_START) * is a valid pointer, therefore we can check against it to determine
goto free_out; * if we need to trim
*/
if (VMALLOC_START > ent->addr) {
if (VMALLOC_START - ent->addr < ent->size) if (VMALLOC_START - ent->addr < ent->size)
ent->size = VMALLOC_START - ent->addr; ent->size = VMALLOC_START - ent->addr;
} }
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment