• Jann Horn's avatar
    vmalloc: fix remap_vmalloc_range() bounds checks · bdebd6a2
    Jann Horn authored
    remap_vmalloc_range() has had various issues with the bounds checks it
    promises to perform ("This function checks that addr is a valid
    vmalloc'ed area, and that it is big enough to cover the vma") over time,
    e.g.:
    
     - not detecting pgoff<<PAGE_SHIFT overflow
    
     - not detecting (pgoff<<PAGE_SHIFT)+usize overflow
    
     - not checking whether addr and addr+(pgoff<<PAGE_SHIFT) are the same
       vmalloc allocation
    
     - comparing a potentially wildly out-of-bounds pointer with the end of
       the vmalloc region
    
    In particular, since commit fc970227 ("bpf: Add mmap() support for
    BPF_MAP_TYPE_ARRAY"), unprivileged users can cause kernel null pointer
    dereferences by calling mmap() on a BPF map with a size that is bigger
    than the distance from the start of the BPF map to the end of the
    address space.
    
    This could theoretically be used as a kernel ASLR bypass, by using
    whether mmap() with a given offset oopses or returns an error code to
    perform a binary search over the possible address range.
    
    To allow remap_vmalloc_range_partial() to verify that addr and
    addr+(pgoff<<PAGE_SHIFT) are in the same vmalloc region, pass the offset
    to remap_vmalloc_range_partial() instead of adding it to the pointer in
    remap_vmalloc_range().
    
    In remap_vmalloc_range_partial(), fix the check against
    get_vm_area_size() by using size comparisons instead of pointer
    comparisons, and add checks for pgoff.
    
    Fixes: 83342314 ("[PATCH] mm: introduce remap_vmalloc_range()")
    Signed-off-by: default avatarJann Horn <jannh@google.com>
    Signed-off-by: default avatarAndrew Morton <akpm@linux-foundation.org>
    Cc: stable@vger.kernel.org
    Cc: Alexei Starovoitov <ast@kernel.org>
    Cc: Daniel Borkmann <daniel@iogearbox.net>
    Cc: Martin KaFai Lau <kafai@fb.com>
    Cc: Song Liu <songliubraving@fb.com>
    Cc: Yonghong Song <yhs@fb.com>
    Cc: Andrii Nakryiko <andriin@fb.com>
    Cc: John Fastabend <john.fastabend@gmail.com>
    Cc: KP Singh <kpsingh@chromium.org>
    Link: http://lkml.kernel.org/r/20200415222312.236431-1-jannh@google.comSigned-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
    bdebd6a2
vmcore.c 40.2 KB