lkml.org 
[lkml]   [2018]   [May]   [28]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 4.9 017/329] ipc/shm: fix shmat() nil address after round-down when remapping
    Date
    4.9-stable review patch.  If anyone has any objections, please let me know.

    ------------------

    From: Davidlohr Bueso <dave@stgolabs.net>

    commit 8f89c007b6dec16a1793cb88de88fcc02117bbbc upstream.

    shmat()'s SHM_REMAP option forbids passing a nil address for; this is in
    fact the very first thing we check for. Andrea reported that for
    SHM_RND|SHM_REMAP cases we can end up bypassing the initial addr check,
    but we need to check again if the address was rounded down to nil. As
    of this patch, such cases will return -EINVAL.

    Link: http://lkml.kernel.org/r/20180503204934.kk63josdu6u53fbd@linux-n805
    Signed-off-by: Davidlohr Bueso <dbueso@suse.de>
    Reported-by: Andrea Arcangeli <aarcange@redhat.com>
    Cc: Joe Lawrence <joe.lawrence@redhat.com>
    Cc: Manfred Spraul <manfred@colorfullife.com>
    Cc: <stable@vger.kernel.org>
    Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
    Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

    ---
    ipc/shm.c | 12 ++++++++++--
    1 file changed, 10 insertions(+), 2 deletions(-)

    --- a/ipc/shm.c
    +++ b/ipc/shm.c
    @@ -1127,9 +1127,17 @@ long do_shmat(int shmid, char __user *sh
    goto out;
    else if ((addr = (ulong)shmaddr)) {
    if (addr & (shmlba - 1)) {
    - if (shmflg & SHM_RND)
    + if (shmflg & SHM_RND) {
    addr &= ~(shmlba - 1); /* round down */
    - else
    +
    + /*
    + * Ensure that the round-down is non-nil
    + * when remapping. This can happen for
    + * cases when addr < shmlba.
    + */
    + if (!addr && (shmflg & SHM_REMAP))
    + goto out;
    + } else
    #ifndef __ARCH_FORCE_SHMLBA
    if (addr & ~PAGE_MASK)
    #endif

    \
     
     \ /
      Last update: 2018-05-28 16:53    [W:4.153 / U:0.308 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site