From patchwork Wed Aug 29 04:04:07 2018 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Dominique Martinet X-Patchwork-Id: 10579523 Return-Path: Received: from mail.wl.linuxfoundation.org (pdx-wl-mail.web.codeaurora.org [172.30.200.125]) by pdx-korg-patchwork-2.web.codeaurora.org (Postfix) with ESMTP id D159D920 for ; Wed, 29 Aug 2018 04:04:14 +0000 (UTC) Received: from mail.wl.linuxfoundation.org (localhost [127.0.0.1]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id B8E392AFDE for ; Wed, 29 Aug 2018 04:04:14 +0000 (UTC) Received: by mail.wl.linuxfoundation.org (Postfix, from userid 486) id ACA552AFEC; Wed, 29 Aug 2018 04:04:14 +0000 (UTC) X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on pdx-wl-mail.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-7.9 required=2.0 tests=BAYES_00,MAILING_LIST_MULTI, RCVD_IN_DNSWL_HI autolearn=ham version=3.3.1 Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id DB8C62AFDE for ; Wed, 29 Aug 2018 04:04:13 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1727115AbeH2H7B (ORCPT ); Wed, 29 Aug 2018 03:59:01 -0400 Received: from nautica.notk.org ([91.121.71.147]:43596 "EHLO nautica.notk.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1726857AbeH2H7A (ORCPT ); Wed, 29 Aug 2018 03:59:00 -0400 Received: by nautica.notk.org (Postfix, from userid 1001) id 7C870C009; Wed, 29 Aug 2018 06:04:10 +0200 (CEST) From: Dominique Martinet To: Omar Sandoval , Andrew Morton Cc: Dominique Martinet , linux-kernel@vger.kernel.org, linux-fsdevel@vger.kernel.org, Alexey Dobriyan , Eric Biederman , James Morse , Bhupesh Sharma , kernel-team@fb.com Subject: [PATCH] proc/kcore: fix invalid memory access in multi-page read optimization Date: Wed, 29 Aug 2018 06:04:07 +0200 Message-Id: <1535515447-21167-1-git-send-email-asmadeus@codewreck.org> X-Mailer: git-send-email 1.7.10.4 In-Reply-To: <20180828105959.GA29204@nautica> References: <20180828105959.GA29204@nautica> Sender: linux-fsdevel-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-fsdevel@vger.kernel.org X-Virus-Scanned: ClamAV using ClamSMTP The 'm' kcore_list item can point to kclist_head, and it is incorrect to look at m->addr / m->size in this case. There is no choice but to run through the list of entries for every address if we did not find any entry in the previous iteration Fixes: bf991c2231117 ("proc/kcore: optimize multiple page reads") Signed-off-by: Dominique Martinet --- I guess now I'm looking at bf991c2231117 again that it would be slightly more efficient to remove the !m check and initialize m to point to kclist_head like this: m = list_entry(&kclist_head, struct kcore_list, list); but it feels a bit forced to me; deferring the choice to others. fs/proc/kcore.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/fs/proc/kcore.c b/fs/proc/kcore.c index ad72261ee3fe..50036f6e1f52 100644 --- a/fs/proc/kcore.c +++ b/fs/proc/kcore.c @@ -451,7 +451,8 @@ read_kcore(struct file *file, char __user *buffer, size_t buflen, loff_t *fpos) * If this is the first iteration or the address is not within * the previous entry, search for a matching entry. */ - if (!m || start < m->addr || start >= m->addr + m->size) { + if (!m || &m->list == &kclist_head || start < m->addr || + start >= m->addr + m->size) { list_for_each_entry(m, &kclist_head, list) { if (start >= m->addr && start < m->addr + m->size)