lkml.org 
[lkml]   [2019]   [Jul]   [29]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 4.19 086/113] mm/gup.c: remove some BUG_ONs from get_gate_page()
    Date
    [ Upstream commit b5d1c39f34d1c9bca0c4b9ae2e339fbbe264a9c7 ]

    If we end up without a PGD or PUD entry backing the gate area, don't BUG
    -- just fail gracefully.

    It's not entirely implausible that this could happen some day on x86. It
    doesn't right now even with an execute-only emulated vsyscall page because
    the fixmap shares the PUD, but the core mm code shouldn't rely on that
    particular detail to avoid OOPSing.

    Link: http://lkml.kernel.org/r/a1d9f4efb75b9d464e59fd6af00104b21c58f6f7.1561610798.git.luto@kernel.org
    Signed-off-by: Andy Lutomirski <luto@kernel.org>
    Reviewed-by: Kees Cook <keescook@chromium.org>
    Reviewed-by: Andrew Morton <akpm@linux-foundation.org>
    Cc: Florian Weimer <fweimer@redhat.com>
    Cc: Jann Horn <jannh@google.com>
    Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
    Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
    Signed-off-by: Sasha Levin <sashal@kernel.org>
    ---
    mm/gup.c | 9 ++++++---
    1 file changed, 6 insertions(+), 3 deletions(-)

    diff --git a/mm/gup.c b/mm/gup.c
    index 43c71397c7ca..f3088d25bd92 100644
    --- a/mm/gup.c
    +++ b/mm/gup.c
    @@ -458,11 +458,14 @@ static int get_gate_page(struct mm_struct *mm, unsigned long address,
    pgd = pgd_offset_k(address);
    else
    pgd = pgd_offset_gate(mm, address);
    - BUG_ON(pgd_none(*pgd));
    + if (pgd_none(*pgd))
    + return -EFAULT;
    p4d = p4d_offset(pgd, address);
    - BUG_ON(p4d_none(*p4d));
    + if (p4d_none(*p4d))
    + return -EFAULT;
    pud = pud_offset(p4d, address);
    - BUG_ON(pud_none(*pud));
    + if (pud_none(*pud))
    + return -EFAULT;
    pmd = pmd_offset(pud, address);
    if (!pmd_present(*pmd))
    return -EFAULT;
    --
    2.20.1


    \
     
     \ /
      Last update: 2019-07-29 22:06    [W:3.037 / U:1.028 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site