On Wed, Dec 19, 2018 at 09:01:09AM +0530, Souptick Joarder wrote:
> On Tue, Dec 18, 2018 at 6:31 PM Russell King - ARM Linux
> <linux@xxxxxxxxxxxxxxx> wrote:
> >
> > On Tue, Dec 18, 2018 at 06:24:29PM +0530, Souptick Joarder wrote:
> > > On Tue, Dec 18, 2018 at 6:03 PM Russell King - ARM Linux
> > > <linux@xxxxxxxxxxxxxxx> wrote:
> > > >
> > > > On Tue, Dec 18, 2018 at 05:36:04PM +0530, Souptick Joarder wrote:
> > > > > On Tue, Dec 18, 2018 at 3:27 PM Russell King - ARM Linux
> > > > > <linux@xxxxxxxxxxxxxxx> wrote:
> > > > > > This looks like a change in behaviour.
> > > > > >
> > > > > > If user_count is zero, and offset is zero, then we pass into
> > > > > > vm_insert_range() a page_count of zero, and vm_insert_range() does
> > > > > > nothing and returns zero.
> > > > > >
> > > > > > However, as we can see from the above code, the original behaviour
> > > > > > was to return -ENXIO in that case.
> > > > >
> > > > > I think these checks are not necessary. I am not sure if we get into mmap
> > > > > handlers of driver with user_count = 0.
> > > >
> > > > I'm not sure either, I'm just pointing out the change of behaviour.
> > >
> > > Ok. I think feedback from Heiko might be helpful here :)
> > >
> > > >
> > > > > > The other thing that I'm wondering is that if (eg) count is 8 (the
> > > > > > object is 8 pages), offset is 2, and the user requests mapping 6
> > > > > > pages (user_count = 6), then we call vm_insert_range() with a
> > > > > > pages of rk_obj->pages + 2, and a pages_count of 6 - 2 = 4. So we
> > > > > > end up inserting four pages.
> > > > >
> > > > > Considering the scenario, user_count will remain 8 (user_count =
> > > > > vma_pages(vma) ). ? No ?
> > > > > Then we call vm_insert_range() with a pages of rk_obj->pages + 2, and
> > > > > a pages_count
> > > > > of 8 - 2 = 6. So we end up inserting 6 pages.
> > > > >
> > > > > Please correct me if I am wrong.
> > > >
> > > > vma_pages(vma) is the number of pages that the user requested, it is
> > > > the difference between vma->vm_end and vma->vm_start in pages. As I
> > > > said above, "the user requests mapping 6 pages", so vma_pages() will
> > > > be 6, and so user_count will also be 6. You are passing
> > > > user_count - offset into vm_insert_range(), which will be 6 - 2 = 4
> > > > in my example. This is two pages short of what the user requested.
> > > >
> > >
> > > So, this should be the correct behavior.
> > >
> > > return vm_insert_range(vma, vma->vm_start,
> > > rk_obj->pages + offset,
> > > user_count);
> >
> > ... and by doing so, you're introducing another instance of the same
> > bug I pointed out in patch 2.
>
> Sorry but didn't get it ? How it will be similar to the bug pointed
> out in patch 2 ?
Towards the top of this function, you have:
unsigned long user_count = vma_pages(vma);
So what you are proposing does:
return vm_insert_range(vma, vma->vm_start, rk_obj->pages + offset,
vma_pages(vma));
Now if we look inside vm_insert_range():
+int vm_insert_range(struct vm_area_struct *vma, unsigned long addr,
+ struct page **pages, unsigned long page_count)
+{
+ unsigned long uaddr = addr;
+ int ret = 0, i;
+
+ if (page_count > vma_pages(vma))
+ return -ENXIO;
+
+ for (i = 0; i < page_count; i++) {
+ ret = vm_insert_page(vma, uaddr, pages[i]);
+ if (ret < 0)
+ return ret;
+ uaddr += PAGE_SIZE;
+ }
So, page_count _is_ vma_pages(vma). So this code does these operations:
if (vma_pages(vma) > vma_pages(vma))
return -ENXIO;
This will always be false. I've already stated in my reply to patch 2
in paragraph 3 about the uselessness of this test.
for (i = 0; i < vma_pages(vma); i++) {
ret = vm_insert_page(vma, uaddr, pages[i]);
So the loop will iterate over the number of pages that the user requested.
Now, taking another example. The object is again 8 pages long, so
indexes 0 through 7 in its page array are valid. The user requests
8 pages at offset 2 into the object. Also as already stated in
paragraph 3 of my reply to patch 2.
vma_pages(vma) is 8. offset = 2.
So we end up _inside_ vm_insert_range() with:
if (8 > 8)
return -ENXIO;
As stated, always false.
for (i = 0; i < 8; i++) {
ret = vm_insert_page(vma, vaddr, rk_obj->pages[2 + i]);
Which means we iterate over rk_obj->pages indicies from 2 through 9
inclusive.
Since only 0 through 7 are valid, we have walked off the end of the
array, and attempted to map an invalid struct page pointer - we could
be lucky, and it could point at some struct page (potentially causing
us to map some sensitive page - maybe containing your bank details or
root password... Or it could oops the kernel.
--
RMK's Patch system: http://www.armlinux.org.uk/developer/patches/
FTTC broadband for 0.8mile line in suburbia: sync at 12.1Mbps down 622kbps up
According to speedtest.net: 11.9Mbps down 500kbps up
