lkml.org 
[lkml]   [2017]   [Feb]   [5]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 3.10 100/319] fix fault_in_multipages_...() on architectures with no-op access_ok()
    Date
    From: Al Viro <viro@ZenIV.linux.org.uk>

    commit e23d4159b109167126e5bcd7f3775c95de7fee47 upstream.

    Switching iov_iter fault-in to multipages variants has exposed an old
    bug in underlying fault_in_multipages_...(); they break if the range
    passed to them wraps around. Normally access_ok() done by callers will
    prevent such (and it's a guaranteed EFAULT - ERR_PTR() values fall into
    such a range and they should not point to any valid objects).

    However, on architectures where userland and kernel live in different
    MMU contexts (e.g. s390) access_ok() is a no-op and on those a range
    with a wraparound can reach fault_in_multipages_...().

    Since any wraparound means EFAULT there, the fix is trivial - turn
    those

    while (uaddr <= end)
    ...
    into

    if (unlikely(uaddr > end))
    return -EFAULT;
    do
    ...
    while (uaddr <= end);

    Reported-by: Jan Stancek <jstancek@redhat.com>
    Tested-by: Jan Stancek <jstancek@redhat.com>
    Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
    Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
    Signed-off-by: Willy Tarreau <w@1wt.eu>
    ---
    include/linux/pagemap.h | 38 +++++++++++++++++++-------------------
    1 file changed, 19 insertions(+), 19 deletions(-)

    diff --git a/include/linux/pagemap.h b/include/linux/pagemap.h
    index e3dea75..9497527 100644
    --- a/include/linux/pagemap.h
    +++ b/include/linux/pagemap.h
    @@ -482,56 +482,56 @@ static inline int fault_in_pages_readable(const char __user *uaddr, int size)
    */
    static inline int fault_in_multipages_writeable(char __user *uaddr, int size)
    {
    - int ret = 0;
    char __user *end = uaddr + size - 1;

    if (unlikely(size == 0))
    - return ret;
    + return 0;

    + if (unlikely(uaddr > end))
    + return -EFAULT;
    /*
    * Writing zeroes into userspace here is OK, because we know that if
    * the zero gets there, we'll be overwriting it.
    */
    - while (uaddr <= end) {
    - ret = __put_user(0, uaddr);
    - if (ret != 0)
    - return ret;
    + do {
    + if (unlikely(__put_user(0, uaddr) != 0))
    + return -EFAULT;
    uaddr += PAGE_SIZE;
    - }
    + } while (uaddr <= end);

    /* Check whether the range spilled into the next page. */
    if (((unsigned long)uaddr & PAGE_MASK) ==
    ((unsigned long)end & PAGE_MASK))
    - ret = __put_user(0, end);
    + return __put_user(0, end);

    - return ret;
    + return 0;
    }

    static inline int fault_in_multipages_readable(const char __user *uaddr,
    int size)
    {
    volatile char c;
    - int ret = 0;
    const char __user *end = uaddr + size - 1;

    if (unlikely(size == 0))
    - return ret;
    + return 0;

    - while (uaddr <= end) {
    - ret = __get_user(c, uaddr);
    - if (ret != 0)
    - return ret;
    + if (unlikely(uaddr > end))
    + return -EFAULT;
    +
    + do {
    + if (unlikely(__get_user(c, uaddr) != 0))
    + return -EFAULT;
    uaddr += PAGE_SIZE;
    - }
    + } while (uaddr <= end);

    /* Check whether the range spilled into the next page. */
    if (((unsigned long)uaddr & PAGE_MASK) ==
    ((unsigned long)end & PAGE_MASK)) {
    - ret = __get_user(c, end);
    - (void)c;
    + return __get_user(c, end);
    }

    - return ret;
    + return 0;
    }

    int add_to_page_cache_locked(struct page *page, struct address_space *mapping,
    --
    2.8.0.rc2.1.gbe9624a
    \
     
     \ /
      Last update: 2017-02-05 20:49    [W:4.134 / U:0.076 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site