| | Date | Fri, 1 Apr 2011 20:26:33 -0400 | | From | Stephen Wilson <> | | Subject | Re: [PATCH v3 2.6.39-rc1-tip 6/26] 6: Uprobes: register/unregister probes. |
| |
On Fri, Apr 01, 2011 at 08:03:38PM +0530, Srikar Dronamraju wrote: > +int register_uprobe(struct inode *inode, loff_t offset, > + struct uprobe_consumer *consumer) > +{ > + struct prio_tree_iter iter; > + struct list_head try_list, success_list; > + struct address_space *mapping; > + struct mm_struct *mm, *tmpmm; > + struct vm_area_struct *vma; > + struct uprobe *uprobe; > + int ret = -1; > + > + if (!inode || !consumer || consumer->next) > + return -EINVAL; > + > + uprobe = uprobes_add(inode, offset); > + if (!uprobe) > + return -ENOMEM; > + > + INIT_LIST_HEAD(&try_list); > + INIT_LIST_HEAD(&success_list); > + mapping = inode->i_mapping; > + > + mutex_lock(&uprobes_mutex); > + if (uprobe->consumers) { > + ret = 0; > + goto consumers_add; > + } > + > + spin_lock(&mapping->i_mmap_lock); > + vma_prio_tree_foreach(vma, &iter, &mapping->i_mmap, 0, 0) { > + loff_t vaddr; > + > + if (!atomic_inc_not_zero(&vma->vm_mm->mm_users)) > + continue; > + > + mm = vma->vm_mm; > + if (!valid_vma(vma)) { > + mmput(mm); > + continue; > + } > + > + vaddr = vma->vm_start + offset; > + vaddr -= vma->vm_pgoff << PAGE_SHIFT;
What happens here when someone passes an offset that is out of bounds for the vma? Looks like we could oops when the kernel tries to set a breakpoint. Perhaps check wrt ->vm_end?
-- steve
|