iv/linux
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

drivers: char: mem: Fix thinkos in kmem address checks

Browse Source 
When borrowing the pfn_valid() check from mmap_kmem(), somebody managed
to get physical and virtual addresses spectacularly muddled up, such
that we've ended up with checks for one being the other. Whilst this
does indeed prevent out-of-bounds accesses crashing, on most systems
it also prevents the more desirable use-case of working at all ever.

Check the *virtual* offset correctly for what it is. Furthermore, do
so in the right place - a read or write may span multiple pages, so a
single up-front check is insufficient. High memory accesses already
have a similar validity check just before the copy_to_user() call, so
just make the low memory path fully consistent with that.

Reported-by: Jason A. Donenfeld <Jason@zx2c4.com>
CC: stable@vger.kernel.org
Fixes: 148a1bc843 ("drivers: char: mem: Check {read,write}_kmem() addresses")
Signed-off-by: Robin Murphy <robin.murphy@arm.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
This commit is contained in:
Robin Murphy 2017-01-05 17:15:01 +00:00 committed by Greg Kroah-Hartman
parent 7ee7f45a76
commit 488debb997
1 changed files with 4 additions and 6 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

10
drivers/char/mem.c
View File

@ -381,9 +381,6 @@ static ssize_t read_kmem(struct file *file, char __user *buf,
char *kbuf; /* k-addr because vread() takes vmlist_lock rwlock */ char *kbuf; /* k-addr because vread() takes vmlist_lock rwlock */
int err = 0; int err = 0;
if (!pfn_valid(PFN_DOWN(p)))
return -EIO;
read = 0; read = 0;
if (p < (unsigned long) high_memory) { if (p < (unsigned long) high_memory) {
low_count = count; low_count = count;
@ -412,6 +409,8 @@ static ssize_t read_kmem(struct file *file, char __user *buf,
* by the kernel or data corruption may occur * by the kernel or data corruption may occur
*/ */
kbuf = xlate_dev_kmem_ptr((void *)p); kbuf = xlate_dev_kmem_ptr((void *)p);
if (!virt_addr_valid(kbuf))
return -ENXIO;
if (copy_to_user(buf, kbuf, sz)) if (copy_to_user(buf, kbuf, sz))
return -EFAULT; return -EFAULT;
@ -482,6 +481,8 @@ static ssize_t do_write_kmem(unsigned long p, const char __user *buf,
* corruption may occur. * corruption may occur.
*/ */
ptr = xlate_dev_kmem_ptr((void *)p); ptr = xlate_dev_kmem_ptr((void *)p);
if (!virt_addr_valid(ptr))
return -ENXIO;
copied = copy_from_user(ptr, buf, sz); copied = copy_from_user(ptr, buf, sz);
if (copied) { if (copied) {
@ -512,9 +513,6 @@ static ssize_t write_kmem(struct file *file, const char __user *buf,
char *kbuf; /* k-addr because vwrite() takes vmlist_lock rwlock */ char *kbuf; /* k-addr because vwrite() takes vmlist_lock rwlock */
int err = 0; int err = 0;
if (!pfn_valid(PFN_DOWN(p)))
return -EIO;
if (p < (unsigned long) high_memory) { if (p < (unsigned long) high_memory) {
unsigned long to_write = min_t(unsigned long, count, unsigned long to_write = min_t(unsigned long, count,
(unsigned long)high_memory - p); (unsigned long)high_memory - p);