Files
rockchip-kernel/include/linux
Jann Horn d8da38eafa vmalloc: fix remap_vmalloc_range() bounds checks
commit bdebd6a283 upstream.

remap_vmalloc_range() has had various issues with the bounds checks it
promises to perform ("This function checks that addr is a valid
vmalloc'ed area, and that it is big enough to cover the vma") over time,
e.g.:

 - not detecting pgoff<<PAGE_SHIFT overflow

 - not detecting (pgoff<<PAGE_SHIFT)+usize overflow

 - not checking whether addr and addr+(pgoff<<PAGE_SHIFT) are the same
   vmalloc allocation

 - comparing a potentially wildly out-of-bounds pointer with the end of
   the vmalloc region

In particular, since commit fc9702273e ("bpf: Add mmap() support for
BPF_MAP_TYPE_ARRAY"), unprivileged users can cause kernel null pointer
dereferences by calling mmap() on a BPF map with a size that is bigger
than the distance from the start of the BPF map to the end of the
address space.

This could theoretically be used as a kernel ASLR bypass, by using
whether mmap() with a given offset oopses or returns an error code to
perform a binary search over the possible address range.

To allow remap_vmalloc_range_partial() to verify that addr and
addr+(pgoff<<PAGE_SHIFT) are in the same vmalloc region, pass the offset
to remap_vmalloc_range_partial() instead of adding it to the pointer in
remap_vmalloc_range().

In remap_vmalloc_range_partial(), fix the check against
get_vm_area_size() by using size comparisons instead of pointer
comparisons, and add checks for pgoff.

Fixes: 833423143c ("[PATCH] mm: introduce remap_vmalloc_range()")
Signed-off-by: Jann Horn <jannh@google.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Cc: stable@vger.kernel.org
Cc: Alexei Starovoitov <ast@kernel.org>
Cc: Daniel Borkmann <daniel@iogearbox.net>
Cc: Martin KaFai Lau <kafai@fb.com>
Cc: Song Liu <songliubraving@fb.com>
Cc: Yonghong Song <yhs@fb.com>
Cc: Andrii Nakryiko <andriin@fb.com>
Cc: John Fastabend <john.fastabend@gmail.com>
Cc: KP Singh <kpsingh@chromium.org>
Link: http://lkml.kernel.org/r/20200415222312.236431-1-jannh@google.com
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2020-04-29 16:31:27 +02:00
..
2019-12-13 08:51:18 +01:00
2019-12-17 20:35:45 +01:00
2018-06-15 18:10:01 -03:00
2019-10-05 13:10:03 +02:00
2019-07-03 13:14:48 +02:00
2018-06-15 18:10:01 -03:00
2018-06-19 10:06:29 -07:00
2018-08-22 10:52:48 -07:00
2019-11-24 08:19:14 +01:00
2018-07-12 10:04:29 -04:00
2020-03-25 08:06:14 +01:00
2018-07-27 09:57:23 +10:00
2020-03-25 08:06:14 +01:00
2019-05-31 06:46:18 -07:00
2018-06-28 20:32:51 +09:00
2019-10-17 13:45:42 -07:00
2018-08-08 11:06:20 +02:00
2018-06-22 13:43:27 +09:00
2019-12-13 08:52:43 +01:00
2018-07-12 21:35:28 +02:00
2018-06-05 08:50:16 -04:00
2018-06-07 17:34:35 -07:00
2019-12-31 16:35:38 +01:00
2018-06-07 17:34:39 -07:00
2018-08-22 10:52:45 -07:00
2018-07-10 17:22:35 +02:00
2018-06-07 17:34:36 -07:00
2018-07-19 11:34:23 +01:00
2020-03-18 07:14:17 +01:00
2018-07-21 10:43:12 -05:00
2018-08-22 10:52:46 -07:00
2019-06-11 12:20:52 +02:00
2018-07-20 01:11:45 +02:00
2018-08-02 17:33:06 -04:00
2018-06-29 08:48:06 -06:00
2020-04-17 10:48:47 +02:00
2020-04-02 15:28:22 +02:00
2018-06-07 17:34:35 -07:00
2018-07-07 17:25:23 +02:00
2018-08-16 12:14:42 -07:00
2019-04-17 08:38:45 +02:00
2018-06-20 11:35:56 +02:00
2018-11-13 11:08:51 -08:00
2019-06-17 19:51:56 +02:00
2020-04-02 15:28:23 +02:00