From: Dominique Martinet <asmadeus@codewreck.org>
To: Omar Sandoval <osandov@osandov.com>,
Andrew Morton <akpm@linux-foundation.org>
Cc: Dominique Martinet <asmadeus@codewreck.org>,
linux-kernel@vger.kernel.org, linux-fsdevel@vger.kernel.org,
Alexey Dobriyan <adobriyan@gmail.com>,
Eric Biederman <ebiederm@xmission.com>,
James Morse <james.morse@arm.com>,
Bhupesh Sharma <bhsharma@redhat.com>,
kernel-team@fb.com
Subject: [PATCH v3] proc/kcore: fix invalid memory access in multi-page read optimization
Date: Wed, 5 Sep 2018 00:38:22 +0200 [thread overview]
Message-ID: <1536100702-28706-1-git-send-email-asmadeus@codewreck.org> (raw)
In-Reply-To: <1536100545-26905-1-git-send-email-asmadeus@codewreck.org>
The 'm' kcore_list item could point to kclist_head, and it is incorrect to
look at m->addr / m->size in this case.
There is no choice but to run through the list of entries for every address
if we did not find any entry in the previous iteration
Reset 'm' to NULL in that case at Omar Sandoval's suggestion.
Fixes: bf991c2231117 ("proc/kcore: optimize multiple page reads")
Signed-off-by: Dominique Martinet <asmadeus@codewreck.org>
---
Sorry, resent v2 because From didn't match sob tag
fs/proc/kcore.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/fs/proc/kcore.c b/fs/proc/kcore.c
index ad72261ee3fe..578926032880 100644
--- a/fs/proc/kcore.c
+++ b/fs/proc/kcore.c
@@ -464,6 +464,7 @@ read_kcore(struct file *file, char __user *buffer, size_t buflen, loff_t *fpos)
ret = -EFAULT;
goto out;
}
+ m = NULL;
} else if (m->type == KCORE_VMALLOC) {
vread(buf, (char *)start, tsz);
/* we have to zero-fill user buffer even if no read */
--
2.17.1
next prev parent reply other threads:[~2018-09-05 3:05 UTC|newest]
Thread overview: 21+ messages / expand[flat|nested] mbox.gz Atom feed top
2018-07-18 22:58 [PATCH v3 0/8] /proc/kcore improvements Omar Sandoval
2018-07-18 22:58 ` [PATCH v3 1/8] proc/kcore: don't grab lock for kclist_add() Omar Sandoval
2018-07-18 22:58 ` [PATCH v3 2/8] proc/kcore: don't grab lock for memory hotplug notifier Omar Sandoval
2018-07-18 22:58 ` [PATCH v3 3/8] proc/kcore: replace kclist_lock rwlock with rwsem Omar Sandoval
2018-07-18 22:58 ` [PATCH v3 4/8] proc/kcore: fix memory hotplug vs multiple opens race Omar Sandoval
2018-07-18 22:58 ` [PATCH v3 5/8] proc/kcore: hold lock during read Omar Sandoval
2018-07-24 15:11 ` Tetsuo Handa
2018-07-25 23:34 ` Omar Sandoval
2018-07-18 22:58 ` [PATCH v3 6/8] proc/kcore: clean up ELF header generation Omar Sandoval
2018-07-18 22:58 ` [PATCH v3 7/8] proc/kcore: optimize multiple page reads Omar Sandoval
2018-08-28 10:59 ` KASAN error in " Dominique Martinet
2018-08-29 4:04 ` [PATCH] proc/kcore: fix invalid memory access in multi-page read optimization Dominique Martinet
2018-09-04 18:03 ` Omar Sandoval
2018-09-04 22:24 ` Dominique Martinet
2018-09-04 22:35 ` [PATCH v2] " Dominique Martinet
2018-09-04 22:38 ` Dominique Martinet [this message]
2018-09-04 22:41 ` [PATCH v3] " Omar Sandoval
2018-09-05 19:56 ` Bhupesh Sharma
2018-09-05 20:57 ` Andrew Morton
2018-09-05 22:00 ` Dominique Martinet
2018-07-18 22:58 ` [PATCH v3 8/8] proc/kcore: add vmcoreinfo note to /proc/kcore Omar Sandoval
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=1536100702-28706-1-git-send-email-asmadeus@codewreck.org \
--to=asmadeus@codewreck.org \
--cc=adobriyan@gmail.com \
--cc=akpm@linux-foundation.org \
--cc=bhsharma@redhat.com \
--cc=ebiederm@xmission.com \
--cc=james.morse@arm.com \
--cc=kernel-team@fb.com \
--cc=linux-fsdevel@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=osandov@osandov.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).