From: Oleg Nesterov <oleg@redhat.com>
To: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Cc: Naresh Kamboju <naresh.kamboju@linaro.org>,
open list <linux-kernel@vger.kernel.org>,
linux- stable <stable@vger.kernel.org>,
Linus Torvalds <torvalds@linux-foundation.org>,
Srikar Dronamraju <srikar@linux.vnet.ibm.com>,
Christian Borntraeger <borntraeger@de.ibm.com>,
Sven Schnelle <svens@linux.ibm.com>,
Steven Rostedt <rostedt@goodmis.org>,
lkft-triage@lists.linaro.org
Subject: Re: [PATCH 4.19 24/25] uprobes: ensure that uprobe->offset and ->ref_ctr_offset are properly aligned
Date: Wed, 10 Jun 2020 16:53:06 +0200 [thread overview]
Message-ID: <20200610145305.GA3254@redhat.com> (raw)
In-Reply-To: <20200609190321.GA1046130@kroah.com>
On 06/09, Greg Kroah-Hartman wrote:
>
> On Wed, Jun 10, 2020 at 12:25:56AM +0530, Naresh Kamboju wrote:
> > > @@ -911,6 +907,15 @@ static int __uprobe_register(struct inod
> > > if (offset > i_size_read(inode))
> > > return -EINVAL;
> > >
> > > + /*
> > > + * This ensures that copy_from_page(), copy_to_page() and
> > > + * __update_ref_ctr() can't cross page boundary.
> > > + */
> > > + if (!IS_ALIGNED(offset, UPROBE_SWBP_INSN_SIZE))
> > > + return -EINVAL;
> > > + if (!IS_ALIGNED(ref_ctr_offset, sizeof(short)))
> >
> > stable-rc 4.19 build failure for x86_64, i386 and arm.
> > make -sk KBUILD_BUILD_USER=TuxBuild -C/linux -j16 ARCH=x86 HOSTCC=gcc
> > CC="sccache gcc" O=build
> >
> > 75 #
> > 76 In file included from ../kernel/events/uprobes.c:25:
> > 77 ../kernel/events/uprobes.c: In function ‘__uprobe_register’:
> > 78 ../kernel/events/uprobes.c:916:18: error: ‘ref_ctr_offset’
> > undeclared (first use in this function); did you mean
> > ‘per_cpu_offset’?
> > 79 916 | if (!IS_ALIGNED(ref_ctr_offset, sizeof(short)))
> > 80 | ^~~~~~~~~~~~~~
> > 81 ../include/linux/kernel.h:62:30: note: in definition of macro ‘IS_ALIGNED’
> > 82 62 | #define IS_ALIGNED(x, a) (((x) & ((typeof(x))(a) - 1)) == 0)
> > 83 | ^
> > 84 ../kernel/events/uprobes.c:916:18: note: each undeclared identifier
> > is reported only once for each function it appears in
> > 85 916 | if (!IS_ALIGNED(ref_ctr_offset, sizeof(short)))
> > 86 | ^~~~~~~~~~~~~~
> > 87 ../include/linux/kernel.h:62:30: note: in definition of macro ‘IS_ALIGNED’
> > 88 62 | #define IS_ALIGNED(x, a) (((x) & ((typeof(x))(a) - 1)) == 0)
> > 89 | ^
> > 90 make[3]: *** [../scripts/Makefile.build:304: kernel/events/uprobes.o] Error 1
> >
> > --
> > Linaro LKFT
> > https://lkft.linaro.org
>
> Good catch, my builders just caught it too :(
>
> 4.19, 4.14, 4.9, and 4.4 are all broken, I have a fix will test it and
> push out -rc2 for all of those with it in a bit, thanks.
Yes, SDT markers were added by 1cc33161a83d20b5462b1e93f95d3ce6388079ee in v4.20.
See the patch for v4.4 below. It changes uprobe_register(), not __uprobe_register()
to check IS_ALIGNED(offset, UPROBE_SWBP_INSN_SIZE) only.
Greg, please let me know if you want me to send the patches for 4.9/4.14/4.19.
Oleg.
--- a/kernel/events/uprobes.c
+++ b/kernel/events/uprobes.c
@@ -601,10 +601,6 @@ static int prepare_uprobe(struct uprobe *uprobe, struct file *file,
if (ret)
goto out;
- /* uprobe_write_opcode() assumes we don't cross page boundary */
- BUG_ON((uprobe->offset & ~PAGE_MASK) +
- UPROBE_SWBP_INSN_SIZE > PAGE_SIZE);
-
smp_wmb(); /* pairs with rmb() in find_active_uprobe() */
set_bit(UPROBE_COPY_INSN, &uprobe->flags);
@@ -883,6 +879,13 @@ int uprobe_register(struct inode *inode, loff_t offset, struct uprobe_consumer *
if (offset > i_size_read(inode))
return -EINVAL;
+ /*
+ * This ensures that copy_from_page() an copy_to_page()
+ * can't cross page boundary.
+ */
+ if (!IS_ALIGNED(offset, UPROBE_SWBP_INSN_SIZE))
+ return -EINVAL;
+
retry:
uprobe = alloc_uprobe(inode, offset);
if (!uprobe)
@@ -1691,6 +1694,9 @@ static int is_trap_at_addr(struct mm_struct *mm, unsigned long vaddr)
uprobe_opcode_t opcode;
int result;
+ if (WARN_ON_ONCE(!IS_ALIGNED(vaddr, UPROBE_SWBP_INSN_SIZE)))
+ return -EINVAL;
+
pagefault_disable();
result = __copy_from_user_inatomic(&opcode, (void __user*)vaddr,
sizeof(opcode));
next prev parent reply other threads:[~2020-06-10 14:53 UTC|newest]
Thread overview: 40+ messages / expand[flat|nested] mbox.gz Atom feed top
2020-06-09 17:44 [PATCH 4.19 00/25] 4.19.128-rc1 review Greg Kroah-Hartman
2020-06-09 17:44 ` [PATCH 4.19 01/25] devinet: fix memleak in inetdev_init() Greg Kroah-Hartman
2020-06-09 17:44 ` [PATCH 4.19 02/25] l2tp: add sk_family checks to l2tp_validate_socket Greg Kroah-Hartman
2020-06-09 17:44 ` [PATCH 4.19 03/25] l2tp: do not use inet_hash()/inet_unhash() Greg Kroah-Hartman
2020-06-09 17:44 ` [PATCH 4.19 04/25] net: usb: qmi_wwan: add Telit LE910C1-EUX composition Greg Kroah-Hartman
2020-06-09 17:44 ` [PATCH 4.19 05/25] NFC: st21nfca: add missed kfree_skb() in an error path Greg Kroah-Hartman
2020-06-09 17:44 ` [PATCH 4.19 06/25] vsock: fix timeout in vsock_accept() Greg Kroah-Hartman
2020-06-09 17:44 ` [PATCH 4.19 07/25] net: check untrusted gso_size at kernel entry Greg Kroah-Hartman
2020-06-09 17:44 ` [PATCH 4.19 08/25] USB: serial: qcserial: add DW5816e QDL support Greg Kroah-Hartman
2020-06-09 17:44 ` [PATCH 4.19 09/25] USB: serial: usb_wwan: do not resubmit rx urb on fatal errors Greg Kroah-Hartman
2020-06-09 17:45 ` [PATCH 4.19 10/25] USB: serial: option: add Telit LE910C1-EUX compositions Greg Kroah-Hartman
2020-06-09 17:45 ` [PATCH 4.19 11/25] iio: vcnl4000: Fix i2c swapped word reading Greg Kroah-Hartman
2020-06-15 13:30 ` Pavel Machek
2020-06-16 8:18 ` Jonathan Cameron
2020-06-09 17:45 ` [PATCH 4.19 12/25] usb: musb: start session in resume for host port Greg Kroah-Hartman
2020-06-09 17:45 ` [PATCH 4.19 13/25] usb: musb: Fix runtime PM imbalance on error Greg Kroah-Hartman
2020-06-09 17:45 ` [PATCH 4.19 14/25] vt: keyboard: avoid signed integer overflow in k_ascii Greg Kroah-Hartman
2020-06-09 17:45 ` [PATCH 4.19 15/25] tty: hvc_console, fix crashes on parallel open/close Greg Kroah-Hartman
2020-06-09 17:45 ` [PATCH 4.19 16/25] staging: rtl8712: Fix IEEE80211_ADDBA_PARAM_BUF_SIZE_MASK Greg Kroah-Hartman
2020-06-09 17:45 ` [PATCH 4.19 17/25] CDC-ACM: heed quirk also in error handling Greg Kroah-Hartman
2020-06-09 17:45 ` [PATCH 4.19 18/25] nvmem: qfprom: remove incorrect write support Greg Kroah-Hartman
2020-06-09 17:45 ` [PATCH 4.19 19/25] x86/cpu: Add a steppings field to struct x86_cpu_id Greg Kroah-Hartman
2020-06-09 17:45 ` [PATCH 4.19 20/25] x86/cpu: Add table argument to cpu_matches() Greg Kroah-Hartman
2020-06-09 17:45 ` [PATCH 4.19 21/25] x86/speculation: Add Special Register Buffer Data Sampling (SRBDS) mitigation Greg Kroah-Hartman
2020-06-09 17:45 ` [PATCH 4.19 22/25] x86/speculation: Add SRBDS vulnerability and mitigation documentation Greg Kroah-Hartman
2020-06-09 17:45 ` [PATCH 4.19 23/25] x86/speculation: Add Ivy Bridge to affected list Greg Kroah-Hartman
2020-06-09 17:45 ` [PATCH 4.19 24/25] uprobes: ensure that uprobe->offset and ->ref_ctr_offset are properly aligned Greg Kroah-Hartman
2020-06-09 18:55 ` Naresh Kamboju
2020-06-09 19:03 ` Greg Kroah-Hartman
2020-06-10 14:53 ` Oleg Nesterov [this message]
2020-06-10 14:58 ` Greg Kroah-Hartman
2020-06-11 16:51 ` Oleg Nesterov
2020-06-12 5:46 ` Greg Kroah-Hartman
2020-06-09 17:45 ` [PATCH 4.19 25/25] Revert "net/mlx5: Annotate mutex destroy for root ns" Greg Kroah-Hartman
2020-06-11 22:17 ` Saeed Mahameed
2020-06-12 1:07 ` Sasha Levin
2020-06-09 19:01 ` [PATCH 4.19 00/25] 4.19.128-rc1 review Naresh Kamboju
2020-06-09 19:20 ` Shuah Khan
2020-06-09 19:41 ` Greg Kroah-Hartman
2020-06-10 11:29 ` Jon Hunter
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20200610145305.GA3254@redhat.com \
--to=oleg@redhat.com \
--cc=borntraeger@de.ibm.com \
--cc=gregkh@linuxfoundation.org \
--cc=linux-kernel@vger.kernel.org \
--cc=lkft-triage@lists.linaro.org \
--cc=naresh.kamboju@linaro.org \
--cc=rostedt@goodmis.org \
--cc=srikar@linux.vnet.ibm.com \
--cc=stable@vger.kernel.org \
--cc=svens@linux.ibm.com \
--cc=torvalds@linux-foundation.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).