Messages in this thread | | | Date | Fri, 5 Aug 2022 10:33:02 -0700 | Subject | Re: [PATCH] lib/cmdline: avoid page fault in next_arg | From | Eric Dumazet <> |
| |
On 7/28/22 16:24, Neel Natu wrote: > An argument list like "arg=val arg2 \"" can trigger a page fault > if the page pointed by 'args[0xffffffff]' is not mapped and potential > memory corruption otherwise (unlikely but possible if the bogus > address is mapped and contents happen to match the ascii value > of the quote character). > > The fix is to ensure that we load 'args[i-1]' only when (i > 0). > > Prior to this commit the following command would trigger an > unhandled page fault in the kernel: > > root@(none):/linus/fs/fat# insmod ./fat.ko "foo=bar \"" > [ 33.870507] BUG: unable to handle page fault for address: ffff888204252608 > [ 33.872180] #PF: supervisor read access in kernel mode > [ 33.873414] #PF: error_code(0x0000) - not-present page > [ 33.874650] PGD 4401067 P4D 4401067 PUD 0 > [ 33.875321] Oops: 0000 [#1] SMP DEBUG_PAGEALLOC PTI > [ 33.876113] CPU: 16 PID: 399 Comm: insmod Not tainted 5.19.0-dbg-DEV #4 > [ 33.877193] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.0-debian-1.16.0-4 04/01/2014 > [ 33.878739] RIP: 0010:next_arg+0xd1/0x110 > [ 33.879399] Code: 22 75 1d 41 c6 04 01 00 41 80 f8 22 74 18 eb 35 4c 89 0e 45 31 d2 4c 89 cf 48 c7 02 00 00 00 00 41 80 f8 22 75 1f 41 8d 42 ff <41> 80 3c 01 22 75 14 41 c6 04 01 00 eb 0d 48 c7 02 00 00 00 00 41 > [ 33.882338] RSP: 0018:ffffc90001253d08 EFLAGS: 00010246 > [ 33.883174] RAX: 00000000ffffffff RBX: ffff888104252608 RCX: 0fc317bba1c1dd00 > [ 33.884311] RDX: ffffc90001253d40 RSI: ffffc90001253d48 RDI: ffff888104252609 > [ 33.885450] RBP: ffffc90001253d10 R08: 0000000000000022 R09: ffff888104252609 > [ 33.886595] R10: 0000000000000000 R11: ffffffff82c7ff20 R12: 0000000000000282 > [ 33.887748] R13: 00000000ffff8000 R14: 0000000000000000 R15: 0000000000007fff > [ 33.888887] FS: 00007f04ec7432c0(0000) GS:ffff88813d300000(0000) knlGS:0000000000000000 > [ 33.890183] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 > [ 33.891111] CR2: ffff888204252608 CR3: 0000000100f36005 CR4: 0000000000170ee0 > [ 33.892241] Call Trace: > [ 33.892641] <TASK> > [ 33.892989] parse_args+0x8f/0x220 > [ 33.893538] load_module+0x138b/0x15a0 > [ 33.894149] ? prepare_coming_module+0x50/0x50 > [ 33.894879] ? kernel_read_file_from_fd+0x5f/0x90 > [ 33.895639] __se_sys_finit_module+0xce/0x130 > [ 33.896342] __x64_sys_finit_module+0x1d/0x20 > [ 33.897042] do_syscall_64+0x44/0xa0 > [ 33.897622] entry_SYSCALL_64_after_hwframe+0x63/0xcd > [ 33.898434] RIP: 0033:0x7f04ec85ef79 > [ 33.899009] Code: 48 8d 3d da db 0d 00 0f 05 eb a5 66 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 8b 0d c7 9e 0d 00 f7 d8 64 89 01 48 > [ 33.901912] RSP: 002b:00007fffae81bfe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000139 > [ 33.903081] RAX: ffffffffffffffda RBX: 0000559c5f1d2640 RCX: 00007f04ec85ef79 > [ 33.904191] RDX: 0000000000000000 RSI: 0000559c5f1d12a0 RDI: 0000000000000003 > [ 33.905304] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 > [ 33.906421] R10: 0000000000000003 R11: 0000000000000246 R12: 0000559c5f1d12a0 > [ 33.907526] R13: 0000000000000000 R14: 0000559c5f1d25f0 R15: 0000559c5f1d12a0 > [ 33.908631] </TASK> > [ 33.908986] Modules linked in: fat(+) [last unloaded: fat] > [ 33.909843] CR2: ffff888204252608 > [ 33.910375] ---[ end trace 0000000000000000 ]--- > [ 33.911172] RIP: 0010:next_arg+0xd1/0x110 > [ 33.911796] Code: 22 75 1d 41 c6 04 01 00 41 80 f8 22 74 18 eb 35 4c 89 0e 45 31 d2 4c 89 cf 48 c7 02 00 00 00 00 41 80 f8 22 75 1f 41 8d 42 ff <41> 80 3c 01 22 75 14 41 c6 04 01 00 eb 0d 48 c7 02 00 00 00 00 41 > [ 33.914643] RSP: 0018:ffffc90001253d08 EFLAGS: 00010246 > [ 33.915446] RAX: 00000000ffffffff RBX: ffff888104252608 RCX: 0fc317bba1c1dd00 > [ 33.916544] RDX: ffffc90001253d40 RSI: ffffc90001253d48 RDI: ffff888104252609 > [ 33.917636] RBP: ffffc90001253d10 R08: 0000000000000022 R09: ffff888104252609 > [ 33.918727] R10: 0000000000000000 R11: ffffffff82c7ff20 R12: 0000000000000282 > [ 33.919821] R13: 00000000ffff8000 R14: 0000000000000000 R15: 0000000000007fff > [ 33.920908] FS: 00007f04ec7432c0(0000) GS:ffff88813d300000(0000) knlGS:0000000000000000 > [ 33.922125] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 > [ 33.923017] CR2: ffff888204252608 CR3: 0000000100f36005 CR4: 0000000000170ee0 > [ 33.924098] Kernel panic - not syncing: Fatal exception > [ 33.925776] Kernel Offset: disabled > [ 33.926347] Rebooting in 10 seconds.. > > Signed-off-by: Neel Natu <neelnatu@google.com>
Reviewed-by: Eric Dumazet <edumazet@google.com>
Thanks.
> --- > lib/cmdline.c | 2 +- > 1 file changed, 1 insertion(+), 1 deletion(-) > > diff --git a/lib/cmdline.c b/lib/cmdline.c > index 5546bf588780..90ed997d9570 100644 > --- a/lib/cmdline.c > +++ b/lib/cmdline.c > @@ -260,7 +260,7 @@ char *next_arg(char *args, char **param, char **val) > args[i-1] = '\0'; > } > } > - if (quoted && args[i-1] == '"') > + if (quoted && i > 0 && args[i-1] == '"') > args[i-1] = '\0'; > > if (args[i]) {
| |