Messages in this thread Patch in this message | | | From | Jinjie Ruan <> | Subject | [PATCH] arm64: Fix 32-bit compatible userspace write size overflow error | Date | Thu, 16 Nov 2023 15:47:05 +0800 |
| |
For 32-bit compatible userspace program, write with size = -1 return not -1 but unexpected other values, which is due to the __access_ok() check is not right. The specified "addr + size" is greater than 32-bit limit and should return -EFAULT, but TASK_SIZE_MAX still defined as UL(1) << VA_BITS in U32 mode, which is much greater than "addr + size" and cannot catch the overflow error.
Fix above error by checking 32-bit limit if it is 32-bit compatible userspace program.
How to reproduce:
The test program is as below:
cat test.c #include <unistd.h> #include <fcntl.h> #include <stdio.h> #include <stdint.h> #include <stdlib.h> #include <assert.h>
#define pinfo(fmt, args...) \ fprintf(stderr, "[INFO][%s][%d][%s]:"fmt, \ __FILE__,__LINE__,__func__,##args)
#undef SIZE_MAX #define SIZE_MAX -1
int main() { char wbuf[3] = { 'x', 'y', 'z' }; char *path = "write.tmp"; int ret;
int fd = open(path, O_RDWR | O_CREAT); if (fd<0) { pinfo("fd=%d\n", fd); exit(-1); }
assert(write(fd, wbuf, 3) == 3);
ret = write (fd, wbuf, SIZE_MAX); pinfo("ret=%d\n", ret); pinfo("size_max=%d\n",SIZE_MAX); assert(ret==-1); close(fd); pinfo("INFO: end\n");
return 0; }
aarch64-linux-gnu-gcc --static test.c -o test arm-linux-gnueabi-gcc --static test.c -o test32
Before applying this patch, userspace 32-bit program return 1112 if the write size = -1 as below: /root # ./test [INFO][test.c][32][main]:ret=-1 [INFO][test.c][33][main]:size_max=-1 [INFO][test.c][36][main]:INFO: end /root # ./test32 [INFO][test.c][32][main]:ret=1112 [INFO][test.c][33][main]:size_max=-1 test32: test.c:34: main: Assertion `ret==-1' failed. Aborted
After applying this patch, userspace 32-bit program return -1 if the write size = -1 as expected as below: /root # ./test [INFO][test.c][32][main]:ret=-1 [INFO][test.c][33][main]:size_max=-1 [INFO][test.c][36][main]:INFO: end /root # ./test32 [INFO][test.c][32][main]:ret=-1 [INFO][test.c][33][main]:size_max=-1 [INFO][test.c][36][main]:INFO: end
Fixes: 967747bbc084 ("uaccess: remove CONFIG_SET_FS") Signed-off-by: Jinjie Ruan <ruanjinjie@huawei.com> --- arch/arm64/include/asm/processor.h | 5 +++++ 1 file changed, 5 insertions(+)
diff --git a/arch/arm64/include/asm/processor.h b/arch/arm64/include/asm/processor.h index e5bc54522e71..6a087d58a90a 100644 --- a/arch/arm64/include/asm/processor.h +++ b/arch/arm64/include/asm/processor.h @@ -52,7 +52,12 @@ #define DEFAULT_MAP_WINDOW_64 (UL(1) << VA_BITS_MIN) #define TASK_SIZE_64 (UL(1) << vabits_actual) +#ifdef CONFIG_COMPAT +#define TASK_SIZE_MAX (test_thread_flag(TIF_32BIT) ? \ + UL(0x100000000) : (UL(1) << VA_BITS)) +#else #define TASK_SIZE_MAX (UL(1) << VA_BITS) +#endif #ifdef CONFIG_COMPAT #if defined(CONFIG_ARM64_64K_PAGES) && defined(CONFIG_KUSER_HELPERS) -- 2.34.1
| |