• Oleg Nesterov's avatar
    uprobes: Fix the memory out of bound overwrite in copy_insn() · 2ded0980
    Oleg Nesterov authored
    1. copy_insn() doesn't look very nice, all calculations are
       confusing and it is not immediately clear why do we read
       the 2nd page first.
    
    2. The usage of inode->i_size is wrong on 32-bit machines.
    
    3. "Instruction at end of binary" logic is simply wrong, it
       doesn't handle the case when uprobe->offset > inode->i_size.
    
       In this case "bytes" overflows, and __copy_insn() writes to
       the memory outside of uprobe->arch.insn.
    
       Yes, uprobe_register() checks i_size_read(), but this file
       can be truncated after that. All i_size checks are racy, we
       do this only to catch the obvious mistakes.
    
    Change copy_insn() to call __copy_insn() in a loop, simplify
    and fix the bytes/nbytes calculations.
    
    Note: we do not care if we read extra bytes after inode->i_size
    if we got the valid page. This is fine because the task gets the
    same page after page-fault, and arch_uprobe_analyze_insn() can't
    know how many bytes were actually read anyway.
    Signed-off-by: default avatarOleg Nesterov <oleg@redhat.com>
    2ded0980
uprobes.c 46.4 KB