From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from kanga.kvack.org (kanga.kvack.org [205.233.56.17]) by smtp.lore.kernel.org (Postfix) with ESMTP id A4C6FC43334 for ; Sun, 12 Jun 2022 17:27:00 +0000 (UTC) Received: by kanga.kvack.org (Postfix) id 9439E8D012D; Sun, 12 Jun 2022 13:26:59 -0400 (EDT) Received: by kanga.kvack.org (Postfix, from userid 40) id 8E6418D011D; Sun, 12 Jun 2022 13:26:59 -0400 (EDT) X-Delivered-To: int-list-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix, from userid 63042) id 7874D8D012D; Sun, 12 Jun 2022 13:26:59 -0400 (EDT) X-Delivered-To: linux-mm@kvack.org Received: from relay.hostedemail.com (smtprelay0013.hostedemail.com [216.40.44.13]) by kanga.kvack.org (Postfix) with ESMTP id 6A5618D011D for ; Sun, 12 Jun 2022 13:26:59 -0400 (EDT) Received: from smtpin04.hostedemail.com (a10.router.float.18 [10.200.18.1]) by unirelay10.hostedemail.com (Postfix) with ESMTP id 3DF00815 for ; Sun, 12 Jun 2022 17:26:59 +0000 (UTC) X-FDA: 79570264158.04.269FE0A Received: from casper.infradead.org (casper.infradead.org [90.155.50.34]) by imf01.hostedemail.com (Postfix) with ESMTP id 5E2F04009B for ; Sun, 12 Jun 2022 17:26:58 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=infradead.org; s=casper.20170209; h=In-Reply-To:Content-Type:MIME-Version: References:Message-ID:Subject:Cc:To:From:Date:Sender:Reply-To: Content-Transfer-Encoding:Content-ID:Content-Description; bh=zrnFIBXm601T4yQOf/WyT3Lwfcbm3/ZR9fWcKu8zKB8=; b=Cc/lSueRI3PMxodzEHYOLMnGM9 pkQXAZnMt3uVgZfLakvT2rHimT3er0bzYwlSyl0kKn9JmNhRX6NVSR3HAimG4x5IKjFeprULEl1H2 p5fZBmAwzWBsFtbS7dveCnRR+F7Li0bMuUuejUGK3d2bVs8genSEfACxcWmrkWl9hhg+TmjRM3MzV AYWHUO6oXYhK19RpPjOb/6tRvfs61qaUDkM7xrp6gMGlB035CyQtC98oZIWuZ6zYrj7uwiFXDpeRG Ep9fnijSlwGtqtRX0kz7UEu8K5UG8Uwm0DPNZNaQObefz3WYWpCmP8nVwfkLsDy4R5HNStj8DXmzM pqlko/gg==; Received: from willy by casper.infradead.org with local (Exim 4.94.2 #2 (Red Hat Linux)) id 1o0RMJ-00G9qW-G0; Sun, 12 Jun 2022 17:26:43 +0000 Date: Sun, 12 Jun 2022 18:26:43 +0100 From: Matthew Wilcox To: Uladzislau Rezki Cc: Zorro Lang , Alexander Gordeev , bugzilla-daemon@kernel.org, linux-s390@vger.kernel.org, linux-xfs@vger.kernel.org, Andrew Morton , linux-mm@kvack.org, Kees Cook Subject: Re: [Bug 216073] New: [s390x] kernel BUG at mm/usercopy.c:101! usercopy: Kernel memory exposure attempt detected from vmalloc 'n o area' (offset 0, size 1)! Message-ID: References: <20220606151312.6a9d098c85ed060d36519600@linux-foundation.org> <20220608021922.n2izu7n4yoadknkx@zlang-mailbox> <20220612044230.murerhsa765akogj@zlang-mailbox> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=hostedemail.com; s=arc-20220608; t=1655054819; h=from:from:sender:reply-to:subject:subject:date:date: message-id:message-id:to:to:cc:cc:mime-version:mime-version: content-type:content-type:content-transfer-encoding: in-reply-to:in-reply-to:references:references:dkim-signature; bh=zrnFIBXm601T4yQOf/WyT3Lwfcbm3/ZR9fWcKu8zKB8=; b=4QOYRrxKZ+7u8UPpCoO1iqscdyDdREI31lIS3+/VNXE7gtpamdqpB090iZndMfoEQ8KMRi zyFWOxjGPucj8jj260H/LkyPtio7EM/MybyqcASlC9L8U7mfcic25vPetPGPv5Mtz+hKen zCNzUQf+SYuNsL/b7oDaCRLanyrw7mg= ARC-Seal: i=1; s=arc-20220608; d=hostedemail.com; t=1655054819; a=rsa-sha256; cv=none; b=1nmfK8tKqIvzLa8VQGkVTLDtVUl2d1Xe3Dv4Cu99DfDkwaWTHU7o2Prt5AwiQVp+ApdMnK oYz+MbGe3Qer2SUBomH+nUNNrUkaEwS9YHVlORoFhi76Q617GwFBLumYRDy9rlX66PjVQp yS1iVxSOicL549aO4pzGx/jZi2drk5U= ARC-Authentication-Results: i=1; imf01.hostedemail.com; dkim=pass header.d=infradead.org header.s=casper.20170209 header.b="Cc/lSueR"; dmarc=none; spf=none (imf01.hostedemail.com: domain of willy@infradead.org has no SPF policy when checking 90.155.50.34) smtp.mailfrom=willy@infradead.org X-Rspamd-Server: rspam11 X-Rspam-User: Authentication-Results: imf01.hostedemail.com; dkim=pass header.d=infradead.org header.s=casper.20170209 header.b="Cc/lSueR"; dmarc=none; spf=none (imf01.hostedemail.com: domain of willy@infradead.org has no SPF policy when checking 90.155.50.34) smtp.mailfrom=willy@infradead.org X-Stat-Signature: 1wyz1gfjjhemksittpj3fs5toezih1zf X-Rspamd-Queue-Id: 5E2F04009B X-HE-Tag: 1655054818-585298 X-Bogosity: Ham, tests=bogofilter, spamicity=0.000000, version=1.2.4 Sender: owner-linux-mm@kvack.org Precedence: bulk X-Loop: owner-majordomo@kvack.org List-ID: On Sun, Jun 12, 2022 at 03:03:20PM +0200, Uladzislau Rezki wrote: > > @@ -181,8 +181,9 @@ static inline void check_heap_object(const void *ptr, unsigned long n, > > return; > > } > > > > - offset = ptr - area->addr; > > - if (offset + n > get_vm_area_size(area)) > > + /* XXX: We should also abort for free vmap_areas */ > > + offset = (unsigned long)ptr - area->va_start; > > > I was a bit confused about "offset" and why it is needed here. It is always zero. > So we can get rid of it to make it less confused. From the other hand a zero offset > contributes to nothing. I don't think offset is necessarily zero. 'ptr' is a pointer somewhere in the object, not necessarily the start of the object. > > > > + if (offset + n >= area->va_end) > > > I think it is a bit wrong. As i see it, "n" is a size and what we would like to do > here is boundary check: > > > if (n > va_size(area)) > usercopy_abort("vmalloc", NULL, to_user, 0, n); > Hmm ... we should probably be more careful about wrapping. if (n > area->va_end - addr) usercopy_abort("vmalloc", NULL, to_user, offset, n); ... and that goes for the whole function actually. I'll split that into a separate change.