Files
android_kernel_xiaomi_sm8450/include/linux
Jann Horn bdebd6a283 vmalloc: fix remap_vmalloc_range() bounds checks
remap_vmalloc_range() has had various issues with the bounds checks it
promises to perform ("This function checks that addr is a valid
vmalloc'ed area, and that it is big enough to cover the vma") over time,
e.g.:

 - not detecting pgoff<<PAGE_SHIFT overflow

 - not detecting (pgoff<<PAGE_SHIFT)+usize overflow

 - not checking whether addr and addr+(pgoff<<PAGE_SHIFT) are the same
   vmalloc allocation

 - comparing a potentially wildly out-of-bounds pointer with the end of
   the vmalloc region

In particular, since commit fc9702273e ("bpf: Add mmap() support for
BPF_MAP_TYPE_ARRAY"), unprivileged users can cause kernel null pointer
dereferences by calling mmap() on a BPF map with a size that is bigger
than the distance from the start of the BPF map to the end of the
address space.

This could theoretically be used as a kernel ASLR bypass, by using
whether mmap() with a given offset oopses or returns an error code to
perform a binary search over the possible address range.

To allow remap_vmalloc_range_partial() to verify that addr and
addr+(pgoff<<PAGE_SHIFT) are in the same vmalloc region, pass the offset
to remap_vmalloc_range_partial() instead of adding it to the pointer in
remap_vmalloc_range().

In remap_vmalloc_range_partial(), fix the check against
get_vm_area_size() by using size comparisons instead of pointer
comparisons, and add checks for pgoff.

Fixes: 833423143c ("[PATCH] mm: introduce remap_vmalloc_range()")
Signed-off-by: Jann Horn <jannh@google.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Cc: stable@vger.kernel.org
Cc: Alexei Starovoitov <ast@kernel.org>
Cc: Daniel Borkmann <daniel@iogearbox.net>
Cc: Martin KaFai Lau <kafai@fb.com>
Cc: Song Liu <songliubraving@fb.com>
Cc: Yonghong Song <yhs@fb.com>
Cc: Andrii Nakryiko <andriin@fb.com>
Cc: John Fastabend <john.fastabend@gmail.com>
Cc: KP Singh <kpsingh@chromium.org>
Link: http://lkml.kernel.org/r/20200415222312.236431-1-jannh@google.com
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
2020-04-21 11:11:56 -07:00
..
2020-03-31 21:29:04 +02:00
2019-12-11 09:12:38 +01:00
2019-11-12 11:43:29 -05:00
2020-03-30 01:34:00 +02:00
2020-04-10 15:36:21 -07:00
2020-01-23 00:35:50 +01:00
2020-03-09 11:12:19 +01:00
2020-02-27 14:58:01 +01:00
2019-12-03 11:20:37 +01:00
2020-02-17 13:37:00 +01:00
2020-01-27 11:09:31 +01:00
2020-01-18 09:19:18 -05:00
2020-03-13 12:49:51 -07:00
2020-03-06 11:06:15 +01:00
2020-03-27 20:19:24 -03:00
2020-04-15 11:48:21 +02:00
2020-03-21 16:00:24 +01:00
2019-12-04 19:44:14 -08:00
2020-01-31 17:33:54 +00:00
2020-02-20 21:17:24 +01:00
2019-12-11 09:12:38 +01:00
2020-04-10 15:36:21 -07:00
2020-03-06 11:56:59 +01:00
2020-04-07 10:43:38 -07:00
2019-12-09 10:55:03 +01:00
2020-03-21 16:00:24 +01:00
2019-11-14 19:06:47 -08:00
2020-01-15 10:54:33 -05:00
2020-01-14 12:20:48 +01:00
2019-12-11 16:37:02 +08:00
2020-04-02 09:35:27 -07:00
2020-04-07 10:43:38 -07:00
2019-11-13 19:09:47 +08:00
2020-01-15 16:30:28 +00:00
2020-04-09 12:15:35 -05:00
2020-03-17 18:31:05 +01:00
2020-01-13 18:16:43 -08:00
2019-11-14 13:07:48 +08:00
2020-03-21 16:00:24 +01:00
2020-02-21 10:31:18 +01:00
2020-04-07 10:43:42 -07:00
2020-03-21 16:00:24 +01:00
2020-03-02 14:04:31 -07:00
2019-11-13 12:15:34 -08:00
2020-02-04 03:05:26 +00:00
2020-03-23 13:41:55 +01:00
2020-02-21 11:22:15 -08:00
2020-01-14 12:20:48 +01:00
2020-03-23 17:01:47 +01:00
2020-04-01 12:06:26 -04:00
2020-04-01 12:06:26 -04:00
2020-04-01 12:06:26 -04:00
2019-11-14 12:20:02 +08:00