linux-fsdevel.vger.kernel.org archive mirror
 help / color / mirror / Atom feed
From: Dominique Martinet <asmadeus@codewreck.org>
To: Omar Sandoval <osandov@osandov.com>,
	Andrew Morton <akpm@linux-foundation.org>
Cc: Dominique Martinet <asmadeus@codewreck.org>,
	linux-kernel@vger.kernel.org, linux-fsdevel@vger.kernel.org,
	Alexey Dobriyan <adobriyan@gmail.com>,
	Eric Biederman <ebiederm@xmission.com>,
	James Morse <james.morse@arm.com>,
	Bhupesh Sharma <bhsharma@redhat.com>,
	kernel-team@fb.com
Subject: [PATCH] proc/kcore: fix invalid memory access in multi-page read optimization
Date: Wed, 29 Aug 2018 06:04:07 +0200	[thread overview]
Message-ID: <1535515447-21167-1-git-send-email-asmadeus@codewreck.org> (raw)
In-Reply-To: <20180828105959.GA29204@nautica>

The 'm' kcore_list item can point to kclist_head, and it is incorrect to
look at m->addr / m->size in this case.
There is no choice but to run through the list of entries for every address
if we did not find any entry in the previous iteration

Fixes: bf991c2231117 ("proc/kcore: optimize multiple page reads")
Signed-off-by: Dominique Martinet <asmadeus@codewreck.org>
---

I guess now I'm looking at bf991c2231117 again that it would be slightly
more efficient to remove the !m check and initialize m to point to
kclist_head like this:
 m = list_entry(&kclist_head, struct kcore_list, list);
but it feels a bit forced to me; deferring the choice to others.

 fs/proc/kcore.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/fs/proc/kcore.c b/fs/proc/kcore.c
index ad72261ee3fe..50036f6e1f52 100644
--- a/fs/proc/kcore.c
+++ b/fs/proc/kcore.c
@@ -451,7 +451,8 @@ read_kcore(struct file *file, char __user *buffer, size_t buflen, loff_t *fpos)
 		 * If this is the first iteration or the address is not within
 		 * the previous entry, search for a matching entry.
 		 */
-		if (!m || start < m->addr || start >= m->addr + m->size) {
+		if (!m || &m->list == &kclist_head || start < m->addr ||
+		    start >= m->addr + m->size) {
 			list_for_each_entry(m, &kclist_head, list) {
 				if (start >= m->addr &&
 				    start < m->addr + m->size)
-- 
2.17.1

  reply	other threads:[~2018-08-29  7:59 UTC|newest]

Thread overview: 21+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2018-07-18 22:58 [PATCH v3 0/8] /proc/kcore improvements Omar Sandoval
2018-07-18 22:58 ` [PATCH v3 1/8] proc/kcore: don't grab lock for kclist_add() Omar Sandoval
2018-07-18 22:58 ` [PATCH v3 2/8] proc/kcore: don't grab lock for memory hotplug notifier Omar Sandoval
2018-07-18 22:58 ` [PATCH v3 3/8] proc/kcore: replace kclist_lock rwlock with rwsem Omar Sandoval
2018-07-18 22:58 ` [PATCH v3 4/8] proc/kcore: fix memory hotplug vs multiple opens race Omar Sandoval
2018-07-18 22:58 ` [PATCH v3 5/8] proc/kcore: hold lock during read Omar Sandoval
2018-07-24 15:11   ` Tetsuo Handa
2018-07-25 23:34     ` Omar Sandoval
2018-07-18 22:58 ` [PATCH v3 6/8] proc/kcore: clean up ELF header generation Omar Sandoval
2018-07-18 22:58 ` [PATCH v3 7/8] proc/kcore: optimize multiple page reads Omar Sandoval
2018-08-28 10:59   ` KASAN error in " Dominique Martinet
2018-08-29  4:04     ` Dominique Martinet [this message]
2018-09-04 18:03       ` [PATCH] proc/kcore: fix invalid memory access in multi-page read optimization Omar Sandoval
2018-09-04 22:24         ` Dominique Martinet
2018-09-04 22:35       ` [PATCH v2] " Dominique Martinet
2018-09-04 22:38         ` [PATCH v3] " Dominique Martinet
2018-09-04 22:41           ` Omar Sandoval
2018-09-05 19:56             ` Bhupesh Sharma
2018-09-05 20:57           ` Andrew Morton
2018-09-05 22:00             ` Dominique Martinet
2018-07-18 22:58 ` [PATCH v3 8/8] proc/kcore: add vmcoreinfo note to /proc/kcore Omar Sandoval

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=1535515447-21167-1-git-send-email-asmadeus@codewreck.org \
    --to=asmadeus@codewreck.org \
    --cc=adobriyan@gmail.com \
    --cc=akpm@linux-foundation.org \
    --cc=bhsharma@redhat.com \
    --cc=ebiederm@xmission.com \
    --cc=james.morse@arm.com \
    --cc=kernel-team@fb.com \
    --cc=linux-fsdevel@vger.kernel.org \
    --cc=linux-kernel@vger.kernel.org \
    --cc=osandov@osandov.com \
    --subject='Re: [PATCH] proc/kcore: fix invalid memory access in multi-page read optimization' \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).