Re: [PATCH] Avoid buffer overflows in get_user_pages()

Andrew Morton <akpm@xxxxxxxxxxxxxxxxxxxx> wrote:
On Mon, 11 Feb 2008 16:17:33 -0700 Jonathan Corbet <corbet@xxxxxxx> wrote:

Avoid buffer overflows in get_user_pages()

So I spent a while pounding my head against my monitor trying to figure
out the vmsplice() vulnerability - how could a failure to check for
*read* access turn into a root exploit? It turns out that it's a buffer
overflow problem which is made easy by the way get_user_pages() is
coded.

In particular, "len" is a signed int, and it is only checked at the
*end* of a do {} while() loop. So, if it is passed in as zero, the loop
will execute once and decrement len to -1. At that point, the loop will
proceed until the next invalid address is found; in the process, it will
likely overflow the pages array passed in to get_user_pages().

[...]

Can we just convert

do {
...
} while (len);

into

while (len) {

while (len > 0), if I understand this patch correctly.

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/

Relevant Pages

  • Re: time returning -1
    ... >> I always thought that time only returned -1 when their was no timer ... Should the loop above be moved into the ... failure of that function, if they test for failure at all. ... > interfering with your timecalls will keep on interfering ...
    (comp.lang.c)
  • Re: if clause
    ... Insisting that all modes of failure and all modes of success ... bail-out code is easy to understand, and the only caveat is "was it a clean ... one of the worst culprits was this "oh, look, we're in six levels of loop, ...
    (comp.lang.c)
  • Re: if clause
    ... Insisting that all modes of failure and all modes of success ... bail-out code is easy to understand, and the only caveat is "was it a clean ... one of the worst culprits was this "oh, look, we're in six levels of loop, ...
    (comp.lang.c)
  • Re: Start An application with a script
    ... The app has actually finished doing its work but hasn't unloaded all ... loop, where the Until condition never actually becomes true (While becomes ... bit of code that is causing the failure. ... > I guess it would indeed help to describe the failure. ...
    (microsoft.public.vb.general.discussion)
  • Re: [PATCH] Avoid buffer overflows in get_user_pages()
    ... overflow problem which is made easy by the way get_user_pagesis ... In particular, "len" is a signed int, and it is only checked at the ... So, if it is passed in as zero, the loop ... unsigned int vm_flags; ...
    (Linux-Kernel)