lkml.org 
[lkml]   [2020]   [Apr]   [3]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    Date
    From
    Subject[PATCH] mm/vmalloc: Sanitize __get_vm_area() arguments

    __get_vm_area() is an exported symbol, make sure the callers stay in
    the expected memory range. When calling this function with memory
    ranges outside of the VMALLOC range *bad* things can happen.

    (I noticed this when I managed to corrupt the kernel text by accident)

    Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
    ---
    mm/vmalloc.c | 7 +++++++
    1 file changed, 7 insertions(+)

    --- a/mm/vmalloc.c
    +++ b/mm/vmalloc.c
    @@ -2130,6 +2130,13 @@ static struct vm_struct *__get_vm_area_n
    struct vm_struct *__get_vm_area(unsigned long size, unsigned long flags,
    unsigned long start, unsigned long end)
    {
    + /*
    + * Ensure callers stay in the vmalloc range.
    + */
    + if (WARN_ON(start < VMALLOC_START || start > VMALLOC_END ||
    + end < VMALLOC_START || end > VMALLOC_END))
    + return NULL;
    +
    return __get_vm_area_node(size, 1, flags, start, end, NUMA_NO_NODE,
    GFP_KERNEL, __builtin_return_address(0));
    }
    \
     
     \ /
      Last update: 2020-04-03 18:33    [W:2.965 / U:0.004 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site