Linux-Fsdevel Archive on lore.kernel.org
 help / color / Atom feed
From: Dominique Martinet <asmadeus@codewreck.org>
To: Omar Sandoval <osandov@osandov.com>,
	Andrew Morton <akpm@linux-foundation.org>
Cc: Dominique Martinet <asmadeus@codewreck.org>,
	linux-kernel@vger.kernel.org, linux-fsdevel@vger.kernel.org,
	Alexey Dobriyan <adobriyan@gmail.com>,
	Eric Biederman <ebiederm@xmission.com>,
	James Morse <james.morse@arm.com>,
	Bhupesh Sharma <bhsharma@redhat.com>,
	kernel-team@fb.com
Subject: [PATCH v3] proc/kcore: fix invalid memory access in multi-page read optimization
Date: Wed,  5 Sep 2018 00:38:22 +0200
Message-ID: <1536100702-28706-1-git-send-email-asmadeus@codewreck.org> (raw)
In-Reply-To: <1536100545-26905-1-git-send-email-asmadeus@codewreck.org>

The 'm' kcore_list item could point to kclist_head, and it is incorrect to
look at m->addr / m->size in this case.
There is no choice but to run through the list of entries for every address
if we did not find any entry in the previous iteration

Reset 'm' to NULL in that case at Omar Sandoval's suggestion.

Fixes: bf991c2231117 ("proc/kcore: optimize multiple page reads")
Signed-off-by: Dominique Martinet <asmadeus@codewreck.org>
---

Sorry, resent v2 because From didn't match sob tag

 fs/proc/kcore.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/fs/proc/kcore.c b/fs/proc/kcore.c
index ad72261ee3fe..578926032880 100644
--- a/fs/proc/kcore.c
+++ b/fs/proc/kcore.c
@@ -464,6 +464,7 @@ read_kcore(struct file *file, char __user *buffer, size_t buflen, loff_t *fpos)
 				ret = -EFAULT;
 				goto out;
 			}
+			m = NULL;
 		} else if (m->type == KCORE_VMALLOC) {
 			vread(buf, (char *)start, tsz);
 			/* we have to zero-fill user buffer even if no read */
-- 
2.17.1

  reply index

Thread overview: 20+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2018-09-04 22:35 [PATCH v2] " Dominique Martinet
2018-09-04 22:38 ` Dominique Martinet [this message]
2018-09-04 22:41   ` [PATCH v3] " Omar Sandoval
2018-09-05 19:56     ` Bhupesh Sharma
2018-09-05 20:57   ` Andrew Morton
2018-09-05 22:00     ` Dominique Martinet
  -- strict thread matches above, loose matches on Subject: below --
2018-07-18 22:58 [PATCH v3 0/8] /proc/kcore improvements Omar Sandoval
2018-07-18 22:58 ` [PATCH v3 1/8] proc/kcore: don't grab lock for kclist_add() Omar Sandoval
2018-07-18 22:58 ` [PATCH v3 2/8] proc/kcore: don't grab lock for memory hotplug notifier Omar Sandoval
2018-07-18 22:58 ` [PATCH v3 3/8] proc/kcore: replace kclist_lock rwlock with rwsem Omar Sandoval
2018-07-18 22:58 ` [PATCH v3 4/8] proc/kcore: fix memory hotplug vs multiple opens race Omar Sandoval
2018-07-18 22:58 ` [PATCH v3 5/8] proc/kcore: hold lock during read Omar Sandoval
2018-07-24 15:11   ` Tetsuo Handa
2018-07-25 23:34     ` Omar Sandoval
2018-07-18 22:58 ` [PATCH v3 6/8] proc/kcore: clean up ELF header generation Omar Sandoval
2018-07-18 22:58 ` [PATCH v3 7/8] proc/kcore: optimize multiple page reads Omar Sandoval
2018-08-28 10:59   ` KASAN error in " Dominique Martinet
2018-08-29  4:04     ` [PATCH] proc/kcore: fix invalid memory access in multi-page read optimization Dominique Martinet
2018-09-04 18:03       ` Omar Sandoval
2018-09-04 22:24         ` Dominique Martinet
2018-07-18 22:58 ` [PATCH v3 8/8] proc/kcore: add vmcoreinfo note to /proc/kcore Omar Sandoval

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=1536100702-28706-1-git-send-email-asmadeus@codewreck.org \
    --to=asmadeus@codewreck.org \
    --cc=adobriyan@gmail.com \
    --cc=akpm@linux-foundation.org \
    --cc=bhsharma@redhat.com \
    --cc=ebiederm@xmission.com \
    --cc=james.morse@arm.com \
    --cc=kernel-team@fb.com \
    --cc=linux-fsdevel@vger.kernel.org \
    --cc=linux-kernel@vger.kernel.org \
    --cc=osandov@osandov.com \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link

Linux-Fsdevel Archive on lore.kernel.org

Archives are clonable:
	git clone --mirror https://lore.kernel.org/linux-fsdevel/0 linux-fsdevel/git/0.git

	# If you have public-inbox 1.1+ installed, you may
	# initialize and index your mirror using the following commands:
	public-inbox-init -V2 linux-fsdevel linux-fsdevel/ https://lore.kernel.org/linux-fsdevel \
		linux-fsdevel@vger.kernel.org
	public-inbox-index linux-fsdevel

Example config snippet for mirrors

Newsgroup available over NNTP:
	nntp://nntp.lore.kernel.org/org.kernel.vger.linux-fsdevel


AGPL code for this site: git clone https://public-inbox.org/public-inbox.git