From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1758234AbcGKM2I (ORCPT ); Mon, 11 Jul 2016 08:28:08 -0400 Received: from mx1.redhat.com ([209.132.183.28]:35467 "EHLO mx1.redhat.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1752568AbcGKM2F (ORCPT ); Mon, 11 Jul 2016 08:28:05 -0400 Date: Mon, 11 Jul 2016 14:28:26 +0200 From: Oleg Nesterov To: Kees Cook Cc: Andrew Morton , Hector Marco-Gisbert , Ismael Ripoll Ripoll , Alexander Viro , "Kirill A. Shutemov" , Chen Gang , Michal Hocko , Konstantin Khlebnikov , Andrea Arcangeli , Andrey Ryabinin , linux-fsdevel@vger.kernel.org, linux-mm@kvack.org, linux-kernel@vger.kernel.org Subject: Re: [PATCH 2/2] mm: refuse wrapped vm_brk requests Message-ID: <20160711122826.GA969@redhat.com> References: <1468014494-25291-1-git-send-email-keescook@chromium.org> <1468014494-25291-3-git-send-email-keescook@chromium.org> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <1468014494-25291-3-git-send-email-keescook@chromium.org> User-Agent: Mutt/1.5.18 (2008-05-17) X-Greylist: Sender IP whitelisted, not delayed by milter-greylist-4.5.16 (mx1.redhat.com [10.5.110.38]); Mon, 11 Jul 2016 12:28:05 +0000 (UTC) Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org I think both patches are fine, just a question. On 07/08, Kees Cook wrote: > > -static int do_brk(unsigned long addr, unsigned long len) > +static int do_brk(unsigned long addr, unsigned long request) > { > struct mm_struct *mm = current->mm; > struct vm_area_struct *vma, *prev; > - unsigned long flags; > + unsigned long flags, len; > struct rb_node **rb_link, *rb_parent; > pgoff_t pgoff = addr >> PAGE_SHIFT; > int error; > > - len = PAGE_ALIGN(len); > + len = PAGE_ALIGN(request); > + if (len < request) > + return -ENOMEM; So iiuc "len < request" is only possible if len == 0, right? > if (!len) > return 0; and thus this patch fixes the error code returned by do_brk() in case of overflow, now it returns -ENOMEM rather than zero. Perhaps if (!len) return 0; len = PAGE_ALIGN(len); if (!len) return -ENOMEM; would be more clear but this is subjective. I am wondering if we should shift this overflow check to the caller(s). Say, sys_brk() does find_vma_intersection(mm, oldbrk, newbrk+PAGE_SIZE) before do_brk(), and in case of overflow find_vma_intersection() can wrongly return NULL. Then do_brk() will be called with len = -oldbrk, this can overflow or not but in any case this doesn't look right too. Or I am totally confused? Oleg. From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Date: Mon, 11 Jul 2016 14:28:26 +0200 From: Oleg Nesterov To: Kees Cook Cc: Andrew Morton , Hector Marco-Gisbert , Ismael Ripoll Ripoll , Alexander Viro , "Kirill A. Shutemov" , Chen Gang , Michal Hocko , Konstantin Khlebnikov , Andrea Arcangeli , Andrey Ryabinin , linux-fsdevel@vger.kernel.org, linux-mm@kvack.org, linux-kernel@vger.kernel.org Subject: Re: [PATCH 2/2] mm: refuse wrapped vm_brk requests Message-ID: <20160711122826.GA969@redhat.com> References: <1468014494-25291-1-git-send-email-keescook@chromium.org> <1468014494-25291-3-git-send-email-keescook@chromium.org> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <1468014494-25291-3-git-send-email-keescook@chromium.org> Sender: owner-linux-mm@kvack.org List-ID: I think both patches are fine, just a question. On 07/08, Kees Cook wrote: > > -static int do_brk(unsigned long addr, unsigned long len) > +static int do_brk(unsigned long addr, unsigned long request) > { > struct mm_struct *mm = current->mm; > struct vm_area_struct *vma, *prev; > - unsigned long flags; > + unsigned long flags, len; > struct rb_node **rb_link, *rb_parent; > pgoff_t pgoff = addr >> PAGE_SHIFT; > int error; > > - len = PAGE_ALIGN(len); > + len = PAGE_ALIGN(request); > + if (len < request) > + return -ENOMEM; So iiuc "len < request" is only possible if len == 0, right? > if (!len) > return 0; and thus this patch fixes the error code returned by do_brk() in case of overflow, now it returns -ENOMEM rather than zero. Perhaps if (!len) return 0; len = PAGE_ALIGN(len); if (!len) return -ENOMEM; would be more clear but this is subjective. I am wondering if we should shift this overflow check to the caller(s). Say, sys_brk() does find_vma_intersection(mm, oldbrk, newbrk+PAGE_SIZE) before do_brk(), and in case of overflow find_vma_intersection() can wrongly return NULL. Then do_brk() will be called with len = -oldbrk, this can overflow or not but in any case this doesn't look right too. Or I am totally confused? Oleg. -- To unsubscribe, send a message with 'unsubscribe linux-mm' in the body to majordomo@kvack.org. For more info on Linux MM, see: http://www.linux-mm.org/ . Don't email: email@kvack.org