Messages in this thread | | | Subject | Re: [PATCH] memory:bugxfix panic on cat or write /dev/kmem | From | "Chenjie (K)" <> | Date | Sat, 25 Jun 2016 09:20:06 +0800 |
| |
On 2016/6/23 20:42, Michal Hocko wrote: > On Fri 24-06-16 01:30:10, chenjie6@huawei.com wrote: >> From: chenjie <chenjie6@huawei.com> >> >> cat /dev/kmem and echo > /dev/kmem will lead panic > > Writing to /dev/kmem without being extremely careful is a disaster AFAIK > and even reading from the file can lead to unexpected results. Anyway > I am trying to understand what exactly you are trying to fix here. Why > writing to/reading from zero pfn should be any special wrt. any other > potentially dangerous addresses >
cat /dev/mem not panic. cat /dev/kmem, just the user's operation for nothing.
>> >> Signed-off-by: chenjie <chenjie6@huawei.com> >> --- >> drivers/char/mem.c | 7 +++++++ >> 1 file changed, 7 insertions(+) >> >> diff --git a/drivers/char/mem.c b/drivers/char/mem.c >> index 71025c2..4bdde28 100644 >> --- a/drivers/char/mem.c >> +++ b/drivers/char/mem.c >> @@ -412,6 +412,8 @@ static ssize_t read_kmem(struct file *file, char __user *buf, >> * by the kernel or data corruption may occur >> */ >> kbuf = xlate_dev_kmem_ptr((void *)p); >> + if (!kbuf) >> + return -EFAULT; >> >> if (copy_to_user(buf, kbuf, sz)) >> return -EFAULT; >> @@ -482,6 +484,11 @@ static ssize_t do_write_kmem(unsigned long p, const char __user *buf, >> * corruption may occur. >> */ >> ptr = xlate_dev_kmem_ptr((void *)p); >> + if (!ptr) { >> + if (written) >> + break; >> + return -EFAULT; >> + } >> >> copied = copy_from_user(ptr, buf, sz); >> if (copied) { >> -- >> 1.8.0 >> >> -- >> To unsubscribe, send a message with 'unsubscribe linux-mm' in >> the body to majordomo@kvack.org. For more info on Linux MM, >> see: http://www.linux-mm.org/ . >> Don't email: <a href=mailto:"dont@kvack.org"> email@kvack.org </a> >
| |