From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from mail-pl1-f195.google.com ([209.85.214.195]:45736 "EHLO mail-pl1-f195.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1726437AbeIDWaG (ORCPT ); Tue, 4 Sep 2018 18:30:06 -0400 Received: by mail-pl1-f195.google.com with SMTP id j8-v6so1983961pll.12 for ; Tue, 04 Sep 2018 11:03:54 -0700 (PDT) Date: Tue, 4 Sep 2018 11:03:52 -0700 From: Omar Sandoval To: Dominique Martinet Cc: Andrew Morton , linux-kernel@vger.kernel.org, linux-fsdevel@vger.kernel.org, Alexey Dobriyan , Eric Biederman , James Morse , Bhupesh Sharma , kernel-team@fb.com Subject: Re: [PATCH] proc/kcore: fix invalid memory access in multi-page read optimization Message-ID: <20180904180352.GA24406@vader> References: <20180828105959.GA29204@nautica> <1535515447-21167-1-git-send-email-asmadeus@codewreck.org> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <1535515447-21167-1-git-send-email-asmadeus@codewreck.org> Sender: linux-fsdevel-owner@vger.kernel.org List-ID: On Wed, Aug 29, 2018 at 06:04:07AM +0200, Dominique Martinet wrote: > The 'm' kcore_list item can point to kclist_head, and it is incorrect to > look at m->addr / m->size in this case. > There is no choice but to run through the list of entries for every address > if we did not find any entry in the previous iteration > > Fixes: bf991c2231117 ("proc/kcore: optimize multiple page reads") > Signed-off-by: Dominique Martinet > --- > > I guess now I'm looking at bf991c2231117 again that it would be slightly > more efficient to remove the !m check and initialize m to point to > kclist_head like this: > m = list_entry(&kclist_head, struct kcore_list, list); > but it feels a bit forced to me; deferring the choice to others. Good catch! Sorry I missed this last week, Google decided this was spam for some reason. How about fixing it like this? One less conditional in the common case, no hacky list_entry :) diff --git a/fs/proc/kcore.c b/fs/proc/kcore.c index ad72261ee3fe..578926032880 100644 --- a/fs/proc/kcore.c +++ b/fs/proc/kcore.c @@ -464,6 +464,7 @@ read_kcore(struct file *file, char __user *buffer, size_t buflen, loff_t *fpos) ret = -EFAULT; goto out; } + m = NULL; } else if (m->type == KCORE_VMALLOC) { vread(buf, (char *)start, tsz); /* we have to zero-fill user buffer even if no read */ > fs/proc/kcore.c | 3 ++- > 1 file changed, 2 insertions(+), 1 deletion(-) > > diff --git a/fs/proc/kcore.c b/fs/proc/kcore.c > index ad72261ee3fe..50036f6e1f52 100644 > --- a/fs/proc/kcore.c > +++ b/fs/proc/kcore.c > @@ -451,7 +451,8 @@ read_kcore(struct file *file, char __user *buffer, size_t buflen, loff_t *fpos) > * If this is the first iteration or the address is not within > * the previous entry, search for a matching entry. > */ > - if (!m || start < m->addr || start >= m->addr + m->size) { > + if (!m || &m->list == &kclist_head || start < m->addr || > + start >= m->addr + m->size) { > list_for_each_entry(m, &kclist_head, list) { > if (start >= m->addr && > start < m->addr + m->size) > -- > 2.17.1 >