lkml.org 
[lkml]   [2023]   [Jul]   [7]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    Date
    Subject[PATCH v4 2/8] mm: userfaultfd: check for start + len overflow in validate_range
    From
    Most userfaultfd ioctls take a `start + len` range as an argument.
    We have the validate_range helper to check that such ranges are valid.
    However, some (but not all!) ioctls *also* check that `start + len`
    doesn't wrap around (overflow).

    Just check for this in validate_range. This saves some repetitive code,
    and adds the check to some ioctls which weren't bothering to check for
    it before.

    Reviewed-by: Peter Xu <peterx@redhat.com>
    Signed-off-by: Axel Rasmussen <axelrasmussen@google.com>
    ---
    fs/userfaultfd.c | 15 +++------------
    1 file changed, 3 insertions(+), 12 deletions(-)

    diff --git a/fs/userfaultfd.c b/fs/userfaultfd.c
    index 7cecd49e078b..2e84684c46f0 100644
    --- a/fs/userfaultfd.c
    +++ b/fs/userfaultfd.c
    @@ -1306,6 +1306,8 @@ static __always_inline int validate_range(struct mm_struct *mm,
    return -EINVAL;
    if (len > task_size - start)
    return -EINVAL;
    + if (start + len <= start)
    + return -EINVAL;
    return 0;
    }

    @@ -1760,14 +1762,8 @@ static int userfaultfd_copy(struct userfaultfd_ctx *ctx,
    ret = validate_range(ctx->mm, uffdio_copy.dst, uffdio_copy.len);
    if (ret)
    goto out;
    - /*
    - * double check for wraparound just in case. copy_from_user()
    - * will later check uffdio_copy.src + uffdio_copy.len to fit
    - * in the userland range.
    - */
    +
    ret = -EINVAL;
    - if (uffdio_copy.src + uffdio_copy.len <= uffdio_copy.src)
    - goto out;
    if (uffdio_copy.mode & ~(UFFDIO_COPY_MODE_DONTWAKE|UFFDIO_COPY_MODE_WP))
    goto out;
    if (uffdio_copy.mode & UFFDIO_COPY_MODE_WP)
    @@ -1927,11 +1923,6 @@ static int userfaultfd_continue(struct userfaultfd_ctx *ctx, unsigned long arg)
    goto out;

    ret = -EINVAL;
    - /* double check for wraparound just in case. */
    - if (uffdio_continue.range.start + uffdio_continue.range.len <=
    - uffdio_continue.range.start) {
    - goto out;
    - }
    if (uffdio_continue.mode & ~(UFFDIO_CONTINUE_MODE_DONTWAKE |
    UFFDIO_CONTINUE_MODE_WP))
    goto out;
    --
    2.41.0.255.g8b1d071c50-goog
    \
     
     \ /
      Last update: 2023-07-07 23:56    [W:5.151 / U:0.008 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site