On Sat, Apr 15, 2023 at 06:52:41PM +0900, Tetsuo Handa wrote:
> On 2023/04/15 18:08, Lorenzo Stoakes wrote:
> > @@ -475,10 +474,14 @@ int uprobe_write_opcode(struct arch_uprobe *auprobe, struct mm_struct *mm,
> > gup_flags |= FOLL_SPLIT_PMD;
> > /* Read the page with vaddr into memory */
> > ret = get_user_pages_remote(mm, vaddr, 1, gup_flags,
> > - &old_page, &vma, NULL);
> > + &old_page, NULL);
> > if (ret <= 0)
> > return ret;
> >
> > + vma = vma_lookup(mm, vaddr);
> > + if (!vma)
> > + goto put_old;
> > +
> > ret = verify_opcode(old_page, vaddr, &opcode);
> > if (ret <= 0)
> > goto put_old;
>
> This conversion looks wrong.
> This causes returning a positive number when vma_lookup() returned NULL.
>
> * Return 0 (success) or a negative errno.
>
In reality it shouldn't be possible for vma to return NULL, I'm adding the
checks to be extra careful.
In any case you're right, attaching a -fix patch to avoid spam:-
----8<----
>From 0710d01ea69ad4e846fa1e56a40b253ff59714ac Mon Sep 17 00:00:00 2001
From: Lorenzo Stoakes <lstoakes@xxxxxxxxx>
Date: Sat, 15 Apr 2023 11:09:15 +0100
Subject: [PATCH] mm/gup: remove vmas parameter from get_user_pages_remote()
Correct vma NULL check as indicated by Tetsuo.
Signed-off-by: Lorenzo Stoakes <lstoakes@xxxxxxxxx>
---
kernel/events/uprobes.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
diff --git a/kernel/events/uprobes.c b/kernel/events/uprobes.c
index b21993cd2dcc..affe42a13eff 100644
--- a/kernel/events/uprobes.c
+++ b/kernel/events/uprobes.c
@@ -479,8 +479,10 @@ int uprobe_write_opcode(struct arch_uprobe *auprobe, struct mm_struct *mm,
return ret;
vma = vma_lookup(mm, vaddr);
- if (!vma)
+ if (!vma) {
+ ret = -EINVAL;
goto put_old;
+ }
ret = verify_opcode(old_page, vaddr, &opcode);
if (ret <= 0)
--
2.40.0
