From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from nautica.notk.org ([91.121.71.147]:43596 "EHLO nautica.notk.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1726857AbeH2H7A (ORCPT ); Wed, 29 Aug 2018 03:59:00 -0400 From: Dominique Martinet To: Omar Sandoval , Andrew Morton Cc: Dominique Martinet , linux-kernel@vger.kernel.org, linux-fsdevel@vger.kernel.org, Alexey Dobriyan , Eric Biederman , James Morse , Bhupesh Sharma , kernel-team@fb.com Subject: [PATCH] proc/kcore: fix invalid memory access in multi-page read optimization Date: Wed, 29 Aug 2018 06:04:07 +0200 Message-Id: <1535515447-21167-1-git-send-email-asmadeus@codewreck.org> In-Reply-To: <20180828105959.GA29204@nautica> References: <20180828105959.GA29204@nautica> Sender: linux-fsdevel-owner@vger.kernel.org List-ID: The 'm' kcore_list item can point to kclist_head, and it is incorrect to look at m->addr / m->size in this case. There is no choice but to run through the list of entries for every address if we did not find any entry in the previous iteration Fixes: bf991c2231117 ("proc/kcore: optimize multiple page reads") Signed-off-by: Dominique Martinet --- I guess now I'm looking at bf991c2231117 again that it would be slightly more efficient to remove the !m check and initialize m to point to kclist_head like this: m = list_entry(&kclist_head, struct kcore_list, list); but it feels a bit forced to me; deferring the choice to others. fs/proc/kcore.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/fs/proc/kcore.c b/fs/proc/kcore.c index ad72261ee3fe..50036f6e1f52 100644 --- a/fs/proc/kcore.c +++ b/fs/proc/kcore.c @@ -451,7 +451,8 @@ read_kcore(struct file *file, char __user *buffer, size_t buflen, loff_t *fpos) * If this is the first iteration or the address is not within * the previous entry, search for a matching entry. */ - if (!m || start < m->addr || start >= m->addr + m->size) { + if (!m || &m->list == &kclist_head || start < m->addr || + start >= m->addr + m->size) { list_for_each_entry(m, &kclist_head, list) { if (start >= m->addr && start < m->addr + m->size) -- 2.17.1