From: Oleg Nesterov <oleg@redhat.com>
To: Frederic Weisbecker <fweisbec@gmail.com>,
Ingo Molnar <mingo@redhat.com>,
Peter Zijlstra <a.p.zijlstra@chello.nl>
Cc: Amnon Shiloh <u3557@miso.sublimeip.com>, linux-kernel@vger.kernel.org
Subject: [PATCH] arch_check_bp_in_kernelspace: fix the range check
Date: Fri, 9 Nov 2012 19:29:43 +0100 [thread overview]
Message-ID: <20121109182943.GA2789@redhat.com> (raw)
arch_check_bp_in_kernelspace() tries to avoid the overflow and does 2
TASK_SIZE checks but it needs OR, not AND. Consider va = TASK_SIZE -1
and len = 2 case.
Note: TASK_SIZE doesn't look right at least on x86, I think it should
be replaced by TASK_SIZE_MAX.
Signed-off-by: Oleg Nesterov <oleg@redhat.com>
--- x/arch/arm64/kernel/hw_breakpoint.c
+++ x/arch/arm64/kernel/hw_breakpoint.c
@@ -293,7 +293,7 @@ int arch_check_bp_in_kernelspace(struct
va = info->address;
len = get_hbp_len(info->ctrl.len);
- return (va >= TASK_SIZE) && ((va + len - 1) >= TASK_SIZE);
+ return (va >= TASK_SIZE) || ((va + len - 1) >= TASK_SIZE);
}
/*
--- x/arch/arm/kernel/hw_breakpoint.c
+++ x/arch/arm/kernel/hw_breakpoint.c
@@ -464,7 +464,7 @@ int arch_check_bp_in_kernelspace(struct
va = info->address;
len = get_hbp_len(info->ctrl.len);
- return (va >= TASK_SIZE) && ((va + len - 1) >= TASK_SIZE);
+ return (va >= TASK_SIZE) || ((va + len - 1) >= TASK_SIZE);
}
/*
--- x/arch/sh/kernel/hw_breakpoint.c
+++ x/arch/sh/kernel/hw_breakpoint.c
@@ -132,7 +132,7 @@ int arch_check_bp_in_kernelspace(struct
va = info->address;
len = get_hbp_len(info->len);
- return (va >= TASK_SIZE) && ((va + len - 1) >= TASK_SIZE);
+ return (va >= TASK_SIZE) || ((va + len - 1) >= TASK_SIZE);
}
int arch_bp_generic_fields(int sh_len, int sh_type,
--- x/arch/x86/kernel/hw_breakpoint.c
+++ x/arch/x86/kernel/hw_breakpoint.c
@@ -200,7 +200,7 @@ int arch_check_bp_in_kernelspace(struct
va = info->address;
len = get_hbp_len(info->len);
- return (va >= TASK_SIZE) && ((va + len - 1) >= TASK_SIZE);
+ return (va >= TASK_SIZE) || ((va + len - 1) >= TASK_SIZE);
}
int arch_bp_generic_fields(int x86_len, int x86_type,
next reply other threads:[~2012-11-09 18:29 UTC|newest]
Thread overview: 60+ messages / expand[flat|nested] mbox.gz Atom feed top
2012-11-09 18:29 Oleg Nesterov [this message]
2012-11-09 18:30 ` [PATCH] arch_check_bp_in_kernelspace: fix the range check Oleg Nesterov
2012-11-19 17:47 ` Oleg Nesterov
2012-11-19 18:25 ` Steven Rostedt
2012-11-20 10:33 ` u3557
2012-11-20 15:48 ` Oleg Nesterov
2012-11-20 15:55 ` Steven Rostedt
2012-11-20 18:32 ` Oleg Nesterov
2012-11-20 23:16 ` u3557
2012-11-21 14:16 ` Oleg Nesterov
2012-11-21 17:30 ` Amnon Shiloh
2012-11-22 16:12 ` vdso && cr (Was: arch_check_bp_in_kernelspace: fix the range check) Oleg Nesterov
2012-11-22 20:57 ` Pavel Emelyanov
2012-11-23 0:20 ` vdso && cr (Was: arch_check_bp_in_kernelspace: fix the range Amnon Shiloh
2012-11-23 17:45 ` Oleg Nesterov
2012-11-24 12:47 ` Amnon Shiloh
2012-11-23 17:42 ` vdso && cr (Was: arch_check_bp_in_kernelspace: fix the range check) Oleg Nesterov
2012-11-23 9:14 ` arch_check_bp_in_kernelspace: fix the range check Amnon Shiloh
2012-11-23 16:33 ` Oleg Nesterov
2012-11-23 17:05 ` Oleg Nesterov
2012-11-24 14:14 ` Amnon Shiloh
2012-11-24 13:45 ` Amnon Shiloh
2012-11-25 22:55 ` Oleg Nesterov
2012-11-25 23:48 ` Amnon Shiloh
2012-12-02 19:30 ` PTRACE_SYSCALL && vsyscall (Was: arch_check_bp_in_kernelspace: fix the range check) Oleg Nesterov
2012-12-02 23:54 ` u3557
2012-12-04 17:59 ` Oleg Nesterov
2012-12-04 22:44 ` u3557
2013-01-08 17:08 ` Pedro Alves
2013-01-09 17:52 ` Oleg Nesterov
2013-01-10 6:54 ` u3557
2013-01-12 18:12 ` Oleg Nesterov
2013-01-14 2:31 ` u3557
2013-01-14 16:01 ` Oleg Nesterov
2013-02-18 1:39 ` prctl(PR_SET_MM) Amnon Shiloh
2013-02-18 5:44 ` prctl(PR_SET_MM) Randy Dunlap
2013-02-18 15:21 ` prctl(PR_SET_MM) Steven Rostedt
2013-02-18 16:33 ` prctl(PR_SET_MM) Amnon Shiloh
2013-02-18 19:49 ` prctl(PR_SET_MM) Steven Rostedt
2013-02-19 6:25 ` prctl(PR_SET_MM) Amnon Shiloh
2013-02-20 8:39 ` prctl(PR_SET_MM) Cyrill Gorcunov
2013-02-20 9:38 ` prctl(PR_SET_MM) Amnon Shiloh
2013-02-20 10:51 ` prctl(PR_SET_MM) Cyrill Gorcunov
2013-02-20 11:16 ` prctl(PR_SET_MM) Amnon Shiloh
2013-02-21 7:46 ` prctl(PR_SET_MM) Amnon Shiloh
2013-02-21 8:00 ` prctl(PR_SET_MM) Cyrill Gorcunov
2013-02-21 8:03 ` prctl(PR_SET_MM) Amnon Shiloh
2013-02-21 8:09 ` prctl(PR_SET_MM) Cyrill Gorcunov
2013-02-21 22:18 ` prctl(PR_SET_MM) Andrew Morton
2013-02-21 22:42 ` prctl(PR_SET_MM) Cyrill Gorcunov
2013-02-22 1:18 ` prctl(PR_SET_MM) Amnon Shiloh
2013-02-22 14:23 ` prctl(PR_SET_MM) Denys Vlasenko
2012-12-05 9:29 ` PTRACE_SYSCALL && vsyscall (Was: arch_check_bp_in_kernelspace: fix the range check) Jan Kratochvil
2012-12-05 13:14 ` u3557
2012-11-26 9:44 ` vdso && cr " Cyrill Gorcunov
2012-11-26 12:27 ` Andrey Wagin
2012-11-26 12:55 ` Amnon Shiloh
2012-11-26 14:18 ` Cyrill Gorcunov
2012-11-26 14:26 ` vdso && cr (Was: arch_check_bp_in_kernelspace: fix the range Amnon Shiloh
2012-11-26 14:41 ` vdso && cr Cyrill Gorcunov
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20121109182943.GA2789@redhat.com \
--to=oleg@redhat.com \
--cc=a.p.zijlstra@chello.nl \
--cc=fweisbec@gmail.com \
--cc=linux-kernel@vger.kernel.org \
--cc=mingo@redhat.com \
--cc=u3557@miso.sublimeip.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.