Message ID | 201909171056.7F2FFD17@keescook (mailing list archive) |
---|---|
State | New, archived |
Headers | show |
Series | [v2] usercopy: Avoid HIGHMEM pfn warning | expand |
On Tue, Sep 17, 2019 at 11:00:25AM -0700, Kees Cook wrote: > When running on a system with >512MB RAM with a 32-bit kernel built with: > > CONFIG_DEBUG_VIRTUAL=y > CONFIG_HIGHMEM=y > CONFIG_HARDENED_USERCOPY=y > > all execve()s will fail due to argv copying into kmap()ed pages, and on > usercopy checking the calls ultimately of virt_to_page() will be looking > for "bad" kmap (highmem) pointers due to CONFIG_DEBUG_VIRTUAL=y: > > Now we can fetch the correct page to avoid the pfn check. In both cases, > hardened usercopy will need to walk the page-span checker (if enabled) > to do sanity checking. > > Reported-by: Randy Dunlap <rdunlap@infradead.org> > Tested-by: Randy Dunlap <rdunlap@infradead.org> > Fixes: f5509cc18daa ("mm: Hardened usercopy") > Cc: Matthew Wilcox <willy@infradead.org> Reviewed-by: Matthew Wilcox (Oracle) <willy@infradead.org> I want to make virt_to_page() do the right thing for kmapped pages, but that is completely outside the scope of this patch.
diff --git a/mm/usercopy.c b/mm/usercopy.c index 98e924864554..660717a1ea5c 100644 --- a/mm/usercopy.c +++ b/mm/usercopy.c @@ -11,6 +11,7 @@ #define pr_fmt(fmt) KBUILD_MODNAME ": " fmt #include <linux/mm.h> +#include <linux/highmem.h> #include <linux/slab.h> #include <linux/sched.h> #include <linux/sched/task.h> @@ -227,7 +228,12 @@ static inline void check_heap_object(const void *ptr, unsigned long n, if (!virt_addr_valid(ptr)) return; - page = virt_to_head_page(ptr); + /* + * When CONFIG_HIGHMEM=y, kmap_to_page() will give either the + * highmem page or fallback to virt_to_page(). The following + * is effectively a highmem-aware virt_to_head_page(). + */ + page = compound_head(kmap_to_page((void *)ptr)); if (PageSlab(page)) { /* Check slab allocator for flags and size. */