From: Davidlohr Bueso <dave@stgolabs.net> To: akpm@linux-foundation.org, aarcange@redhat.com Cc: joe.lawrence@redhat.com, gareth.evans@contextis.co.uk, linux-kernel@vger.kernel.org, linux-mm@kvack.org, stable@kernel.org, dave@stgolabs.net Subject: [PATCH 2/2] ipc/shm: fix shmat() nil address after round-down when remapping Date: Thu, 3 May 2018 13:49:34 -0700 [thread overview] Message-ID: <20180503204934.kk63josdu6u53fbd@linux-n805> (raw) In-Reply-To: <20180503203243.15045-1-dave@stgolabs.net> shmat()'s SHM_REMAP option forbids passing a nil address for; this is in fact the very first thing we check for. Andrea reported that for SHM_RND|SHM_REMAP cases we can end up bypassing the initial addr check, but we need to check again if the address was rounded down to nil. As of this patch, such cases will return -EINVAL. Reported-by: Andrea Arcangeli <aarcange@redhat.com> Signed-off-by: Davidlohr Bueso <dbueso@suse.de> --- ipc/shm.c | 12 ++++++++++-- 1 file changed, 10 insertions(+), 2 deletions(-) diff --git a/ipc/shm.c b/ipc/shm.c index b81d53c8f459..29978ee76c2e 100644 --- a/ipc/shm.c +++ b/ipc/shm.c @@ -1371,9 +1371,17 @@ long do_shmat(int shmid, char __user *shmaddr, int shmflg, if (addr) { if (addr & (shmlba - 1)) { - if (shmflg & SHM_RND) + if (shmflg & SHM_RND) { addr &= ~(shmlba - 1); /* round down */ - else + + /* + * Ensure that the round-down is non-nil + * when remapping. This can happen for + * cases when addr < shmlba. + */ + if (!addr && (shmflg & SHM_REMAP)) + goto out; + } else #ifndef __ARCH_FORCE_SHMLBA if (addr & ~PAGE_MASK) #endif -- 2.13.6
next prev parent reply other threads:[~2018-05-03 21:04 UTC|newest] Thread overview: 7+ messages / expand[flat|nested] mbox.gz Atom feed top 2018-05-03 20:32 [PATCH -next 0/2] ipc/shm: shmat() fixes around nil-page Davidlohr Bueso 2018-05-03 20:32 ` [PATCH 1/2] Revert "ipc/shm: Fix shmat mmap nil-page protection" Davidlohr Bueso 2018-05-03 20:49 ` Davidlohr Bueso [this message] 2018-05-10 18:17 ` [PATCH -next 0/2] ipc/shm: shmat() fixes around nil-page Vlastimil Babka 2018-05-10 18:17 ` [LTP] " Vlastimil Babka 2018-05-14 16:19 ` Davidlohr Bueso 2018-05-14 16:19 ` [LTP] " Davidlohr Bueso
Reply instructions: You may reply publicly to this message via plain-text email using any one of the following methods: * Save the following mbox file, import it into your mail client, and reply-to-all from there: mbox Avoid top-posting and favor interleaved quoting: https://en.wikipedia.org/wiki/Posting_style#Interleaved_style * Reply using the --to, --cc, and --in-reply-to switches of git-send-email(1): git send-email \ --in-reply-to=20180503204934.kk63josdu6u53fbd@linux-n805 \ --to=dave@stgolabs.net \ --cc=aarcange@redhat.com \ --cc=akpm@linux-foundation.org \ --cc=gareth.evans@contextis.co.uk \ --cc=joe.lawrence@redhat.com \ --cc=linux-kernel@vger.kernel.org \ --cc=linux-mm@kvack.org \ --cc=stable@kernel.org \ --subject='Re: [PATCH 2/2] ipc/shm: fix shmat() nil address after round-down when remapping' \ /path/to/YOUR_REPLY https://kernel.org/pub/software/scm/git/docs/git-send-email.html * If your mail client supports setting the In-Reply-To header via mailto: links, try the mailto: link
This is an external index of several public inboxes, see mirroring instructions on how to clone and mirror all data and code used by this external index.