* [PATCH] mm/gup: Remove some BUG_ONs from get_gate_page()
@ 2019-06-27 4:47 Andy Lutomirski
2019-06-27 15:53 ` Kees Cook
0 siblings, 1 reply; 2+ messages in thread
From: Andy Lutomirski @ 2019-06-27 4:47 UTC (permalink / raw)
To: LKML, Linux-MM, Andrew Morton
Cc: x86, Kees Cook, Florian Weimer, Jann Horn, Andy Lutomirski
If we end up without a PGD or PUD entry backing the gate area, don't
BUG -- just fail gracefully.
It's not entirely implausible that this could happen some day on
x86. It doesn't right now even with an execute-only emulated
vsyscall page because the fixmap shares the PUD, but the core mm
code shouldn't rely on that particular detail to avoid OOPSing.
Signed-off-by: Andy Lutomirski <luto@kernel.org>
---
mm/gup.c | 9 ++++++---
1 file changed, 6 insertions(+), 3 deletions(-)
diff --git a/mm/gup.c b/mm/gup.c
index ddde097cf9e4..9883b598fd6f 100644
--- a/mm/gup.c
+++ b/mm/gup.c
@@ -585,11 +585,14 @@ static int get_gate_page(struct mm_struct *mm, unsigned long address,
pgd = pgd_offset_k(address);
else
pgd = pgd_offset_gate(mm, address);
- BUG_ON(pgd_none(*pgd));
+ if (pgd_none(*pgd))
+ return -EFAULT;
p4d = p4d_offset(pgd, address);
- BUG_ON(p4d_none(*p4d));
+ if (p4d_none(*p4d))
+ return -EFAULT;
pud = pud_offset(p4d, address);
- BUG_ON(pud_none(*pud));
+ if (pud_none(*pud))
+ return -EFAULT;
pmd = pmd_offset(pud, address);
if (!pmd_present(*pmd))
return -EFAULT;
--
2.21.0
^ permalink raw reply related [flat|nested] 2+ messages in thread
* Re: [PATCH] mm/gup: Remove some BUG_ONs from get_gate_page()
2019-06-27 4:47 [PATCH] mm/gup: Remove some BUG_ONs from get_gate_page() Andy Lutomirski
@ 2019-06-27 15:53 ` Kees Cook
0 siblings, 0 replies; 2+ messages in thread
From: Kees Cook @ 2019-06-27 15:53 UTC (permalink / raw)
To: Andy Lutomirski
Cc: LKML, Linux-MM, Andrew Morton, x86, Florian Weimer, Jann Horn
On Wed, Jun 26, 2019 at 09:47:30PM -0700, Andy Lutomirski wrote:
> If we end up without a PGD or PUD entry backing the gate area, don't
> BUG -- just fail gracefully.
>
> It's not entirely implausible that this could happen some day on
> x86. It doesn't right now even with an execute-only emulated
> vsyscall page because the fixmap shares the PUD, but the core mm
> code shouldn't rely on that particular detail to avoid OOPSing.
>
> Signed-off-by: Andy Lutomirski <luto@kernel.org>
Reviewed-by: Kees Cook <keescook@chromium.org>
-Kees
> ---
> mm/gup.c | 9 ++++++---
> 1 file changed, 6 insertions(+), 3 deletions(-)
>
> diff --git a/mm/gup.c b/mm/gup.c
> index ddde097cf9e4..9883b598fd6f 100644
> --- a/mm/gup.c
> +++ b/mm/gup.c
> @@ -585,11 +585,14 @@ static int get_gate_page(struct mm_struct *mm, unsigned long address,
> pgd = pgd_offset_k(address);
> else
> pgd = pgd_offset_gate(mm, address);
> - BUG_ON(pgd_none(*pgd));
> + if (pgd_none(*pgd))
> + return -EFAULT;
> p4d = p4d_offset(pgd, address);
> - BUG_ON(p4d_none(*p4d));
> + if (p4d_none(*p4d))
> + return -EFAULT;
> pud = pud_offset(p4d, address);
> - BUG_ON(pud_none(*pud));
> + if (pud_none(*pud))
> + return -EFAULT;
> pmd = pmd_offset(pud, address);
> if (!pmd_present(*pmd))
> return -EFAULT;
> --
> 2.21.0
>
--
Kees Cook
^ permalink raw reply [flat|nested] 2+ messages in thread
end of thread, other threads:[~2019-06-27 15:53 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2019-06-27 4:47 [PATCH] mm/gup: Remove some BUG_ONs from get_gate_page() Andy Lutomirski
2019-06-27 15:53 ` Kees Cook
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).