From: Andrew Morton <akpm@linux-foundation.org>
To: Tommi Rantala <tt.rantala@gmail.com>
Cc: Michel Lespinasse <walken@google.com>,
Andy Lutomirski <luto@amacapital.net>,
Ingo Molnar <mingo@kernel.org>, Al Viro <viro@zeniv.linux.org.uk>,
Hugh Dickins <hughd@google.com>, Jorn_Engel <joern@logfs.org>,
Rik van Riel <riel@redhat.com>,
"linux-mm@kvack.org" <linux-mm@kvack.org>,
LKML <linux-kernel@vger.kernel.org>,
Dave Jones <davej@redhat.com>
Subject: Re: [PATCH 4/9] mm: use mm_populate() for blocking remap_file_pages()
Date: Mon, 11 Mar 2013 16:03:22 -0700 [thread overview]
Message-ID: <20130311160322.830cc6b670fd24faa8366413@linux-foundation.org> (raw)
In-Reply-To: <CA+ydwtqD67m9_JLCNwvdP72rko93aTkVgC-aK4TacyyM5DoCTA@mail.gmail.com>
On Sun, 10 Mar 2013 20:55:21 +0200 Tommi Rantala <tt.rantala@gmail.com> wrote:
> 2012/12/21 Michel Lespinasse <walken@google.com>:
> > Signed-off-by: Michel Lespinasse <walken@google.com>
>
> Hello, this patch introduced the following bug, seen while fuzzing with trinity:
>
> [ 396.825414] BUG: unable to handle kernel NULL pointer dereference
> at 0000000000000050
>
> ...
>
> > + vm_flags = vma->vm_flags;
>
> When find_vma() fails, vma is NULL here.
Yup, thanks.
This, methinks:
From: Andrew Morton <akpm@linux-foundation.org>
Subject: mm/fremap.c: fix oops on error path
If find_vma() fails, sys_remap_file_pages() will dereference `vma', which
contains NULL. Fix it by checking the pointer.
(We could alternatively check for err==0, but this seems more direct)
(The vm_flags change is to squish a bogus used-uninitialised warning
without adding extra code).
Reported-by: Tommi Rantala <tt.rantala@gmail.com>
Cc: Michel Lespinasse <walken@google.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
---
mm/fremap.c | 6 ++++--
1 file changed, 4 insertions(+), 2 deletions(-)
diff -puN mm/fremap.c~mm-fremapc-fix-oops-on-error-path mm/fremap.c
--- a/mm/fremap.c~mm-fremapc-fix-oops-on-error-path
+++ a/mm/fremap.c
@@ -163,7 +163,8 @@ SYSCALL_DEFINE5(remap_file_pages, unsign
* and that the remapped range is valid and fully within
* the single existing vma.
*/
- if (!vma || !(vma->vm_flags & VM_SHARED))
+ vm_flags = vma->vm_flags;
+ if (!vma || !(vm_flags & VM_SHARED))
goto out;
if (!vma->vm_ops || !vma->vm_ops->remap_pages)
@@ -254,7 +255,8 @@ get_write_lock:
*/
out:
- vm_flags = vma->vm_flags;
+ if (vma)
+ vm_flags = vma->vm_flags;
if (likely(!has_write_lock))
up_read(&mm->mmap_sem);
else
_
--
To unsubscribe, send a message with 'unsubscribe linux-mm' in
the body to majordomo@kvack.org. For more info on Linux MM,
see: http://www.linux-mm.org/ .
Don't email: <a href=mailto:"dont@kvack.org"> email@kvack.org </a>
next prev parent reply other threads:[~2013-03-11 23:03 UTC|newest]
Thread overview: 40+ messages / expand[flat|nested] mbox.gz Atom feed top
2012-12-21 0:49 [PATCH 0/9] Avoid populating unbounded num of ptes with mmap_sem held Michel Lespinasse
2012-12-21 0:49 ` [PATCH 1/9] mm: make mlockall preserve flags other than VM_LOCKED in def_flags Michel Lespinasse
2012-12-22 4:25 ` Rik van Riel
2012-12-21 0:49 ` [PATCH 2/9] mm: remap_file_pages() fixes Michel Lespinasse
2013-01-03 0:31 ` Rik van Riel
2012-12-21 0:49 ` [PATCH 3/9] mm: introduce mm_populate() for populating new vmas Michel Lespinasse
2013-01-03 2:14 ` Rik van Riel
2012-12-21 0:49 ` [PATCH 4/9] mm: use mm_populate() for blocking remap_file_pages() Michel Lespinasse
2013-01-03 2:25 ` Rik van Riel
2013-03-10 18:55 ` Tommi Rantala
2013-03-11 23:03 ` Andrew Morton [this message]
2013-03-12 0:24 ` Michel Lespinasse
2013-03-12 4:23 ` Hillf Danton
2013-03-12 5:01 ` Michel Lespinasse
2013-03-12 20:47 ` Andrew Morton
2012-12-21 0:49 ` [PATCH 5/9] mm: use mm_populate() when adjusting brk with MCL_FUTURE in effect Michel Lespinasse
2013-01-03 2:56 ` Rik van Riel
2012-12-21 0:49 ` [PATCH 6/9] mm: use mm_populate() for mremap() of VM_LOCKED vmas Michel Lespinasse
2013-01-03 5:47 ` Rik van Riel
2012-12-21 0:49 ` [PATCH 7/9] mm: remove flags argument to mmap_region Michel Lespinasse
2013-01-03 5:49 ` Rik van Riel
2012-12-21 0:49 ` [PATCH 8/9] mm: directly use __mlock_vma_pages_range() in find_extend_vma() Michel Lespinasse
2013-01-03 5:50 ` Rik van Riel
2012-12-21 0:49 ` [PATCH 9/9] mm: introduce VM_POPULATE flag to better deal with racy userspace programs Michel Lespinasse
2013-01-03 6:20 ` Rik van Riel
2012-12-21 10:46 ` [PATCH 0/9] Avoid populating unbounded num of ptes with mmap_sem held Michel Lespinasse
2012-12-22 15:02 ` Greg Ungerer
2013-01-23 13:37 ` Greg Ungerer
2012-12-22 0:36 ` Andy Lutomirski
2012-12-22 0:59 ` Michel Lespinasse
2012-12-22 1:09 ` Andy Lutomirski
2012-12-22 1:59 ` Michel Lespinasse
2012-12-22 2:16 ` Andy Lutomirski
2012-12-22 9:37 ` Michel Lespinasse
2012-12-22 9:45 ` [PATCH 10/9] mm: make do_mmap_pgoff return populate as a size in bytes, not as a bool Michel Lespinasse
2013-01-03 6:21 ` Rik van Riel
2013-01-03 18:54 ` Andy Lutomirski
2013-01-03 18:56 ` [PATCH 0/9] Avoid populating unbounded num of ptes with mmap_sem held Andy Lutomirski
2013-01-04 18:16 ` Andy Lutomirski
2013-01-04 22:58 ` Michel Lespinasse
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20130311160322.830cc6b670fd24faa8366413@linux-foundation.org \
--to=akpm@linux-foundation.org \
--cc=davej@redhat.com \
--cc=hughd@google.com \
--cc=joern@logfs.org \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-mm@kvack.org \
--cc=luto@amacapital.net \
--cc=mingo@kernel.org \
--cc=riel@redhat.com \
--cc=tt.rantala@gmail.com \
--cc=viro@zeniv.linux.org.uk \
--cc=walken@google.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox