mirrors
/
linux-stable
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
1
0
Fork 0
Code Issues Releases Wiki Activity
721,079 Commits 103 Branches 5,012 Tags 5.4 GiB
C 97.6%
Assembly 1%
Shell 0.5%
Python 0.3%
Makefile 0.3%
Go to file
Kees Cook a93e0bcdbd usercopy: Avoid HIGHMEM pfn warning 
commit 314eed30ed upstream.

When running on a system with >512MB RAM with a 32-bit kernel built with:

	CONFIG_DEBUG_VIRTUAL=y
	CONFIG_HIGHMEM=y
	CONFIG_HARDENED_USERCOPY=y

all execve()s will fail due to argv copying into kmap()ed pages, and on
usercopy checking the calls ultimately of virt_to_page() will be looking
for "bad" kmap (highmem) pointers due to CONFIG_DEBUG_VIRTUAL=y:

 ------------[ cut here ]------------
 kernel BUG at ../arch/x86/mm/physaddr.c:83!
 invalid opcode: 0000 [#1] PREEMPT SMP DEBUG_PAGEALLOC
 CPU: 1 PID: 1 Comm: swapper/0 Not tainted 5.3.0-rc8 #6
 Hardware name: Dell Inc. Inspiron 1318/0C236D, BIOS A04 01/15/2009
 EIP: __phys_addr+0xaf/0x100
 ...
 Call Trace:
  __check_object_size+0xaf/0x3c0
  ? __might_sleep+0x80/0xa0
  copy_strings+0x1c2/0x370
  copy_strings_kernel+0x2b/0x40
  __do_execve_file+0x4ca/0x810
  ? kmem_cache_alloc+0x1c7/0x370
  do_execve+0x1b/0x20
  ...

The check is from arch/x86/mm/physaddr.c:

	VIRTUAL_BUG_ON((phys_addr >> PAGE_SHIFT) > max_low_pfn);

Due to the kmap() in fs/exec.c:

		kaddr = kmap(kmapped_page);
	...
	if (copy_from_user(kaddr+offset, str, bytes_to_copy)) ...

Now we can fetch the correct page to avoid the pfn check. In both cases,
hardened usercopy will need to walk the page-span checker (if enabled)
to do sanity checking.

Reported-by: Randy Dunlap <rdunlap@infradead.org>
Tested-by: Randy Dunlap <rdunlap@infradead.org>
Fixes: f5509cc18d ("mm: Hardened usercopy")
Cc: Matthew Wilcox <willy@infradead.org>
Cc: stable@vger.kernel.org
Signed-off-by: Kees Cook <keescook@chromium.org>
Reviewed-by: Matthew Wilcox (Oracle) <willy@infradead.org>
Link: https://lore.kernel.org/r/201909171056.7F2FFD17@keescook
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
 		2019-10-11 18:18:34 +02:00
Documentation x86/CPU/AMD: Clear RDRAND CPUID bit on AMD family 15h/16h 2019-08-29 08:26:43 +02:00
arch powerpc/powernv: Restrict OPAL symbol map to only be readable by root 2019-10-11 18:18:31 +02:00
block blk-mq: move cancel of requeue_work to the front of blk_exit_queue 2019-10-05 12:47:37 +02:00
certs Replace magic for trusting the secondary keyring with #define 2018-09-09 19:55:54 +02:00
crypto crypto: skcipher - Unmap pages after an external error 2019-10-11 18:18:32 +02:00
drivers crypto: caam - fix concurrency issue in givencrypt descriptor 2019-10-11 18:18:33 +02:00
firmware License cleanup: add SPDX GPL-2.0 license identifier to files with no license 2017-11-02 11:10:55 +01:00
fs ocfs2: wait for recovering done after direct unlock request 2019-10-07 18:55:14 +02:00
include ASoC: Define a set of DAPM pre/post-up events 2019-10-11 18:18:30 +02:00
init init: initialize jump labels before command line option parsing 2019-05-16 19:42:23 +02:00
ipc ipc/mqueue.c: only perform resource calculation if user valid 2019-08-06 19:05:24 +02:00
kernel kexec: bail out upon SIGKILL when allocating memory. 2019-10-07 18:55:23 +02:00
lib kmemleak: increase DEBUG_KMEMLEAK_EARLY_LOG_SIZE default to 16K 2019-10-07 18:55:15 +02:00
mm usercopy: Avoid HIGHMEM pfn warning 2019-10-11 18:18:34 +02:00
net NFC: fix attrs checks in netlink interface 2019-10-07 18:55:22 +02:00
samples samples, bpf: fix to change the buffer size for read() 2019-07-21 09:04:17 +02:00
scripts randstruct: Check member structs in is_pure_ops_struct() 2019-10-05 12:48:05 +02:00
security smack: use GFP_NOFS while holding inode_smack::smk_lock 2019-10-07 18:55:22 +02:00
sound ASoC: Intel: Fix use of potentially uninitialized variable 2019-10-05 12:48:07 +02:00
tools tools lib traceevent: Fix "robust" test of do_generate_dynamic_list_file 2019-10-11 18:18:32 +02:00
usr kbuild: clean compressed initramfs image 2019-10-07 18:55:14 +02:00
virt KVM: coalesced_mmio: add bounds checking 2019-09-21 07:15:28 +02:00
.cocciconfig
…
.get_maintainer.ignore
…
.gitattributes .gitattributes: set git diff driver for C source code files 2016-10-07 18:46:30 -07:00
.gitignore kbuild: rpm-pkg: keep spec file until make mrproper 2018-02-13 10:19:46 +01:00
.mailmap .mailmap: Add Maciej W. Rozycki's Imagination e-mail address 2017-11-10 12:16:15 -08:00
COPYING
…
CREDITS MAINTAINERS: update TPM driver infrastructure changes 2017-11-09 17:58:40 -08:00
Kbuild License cleanup: add SPDX GPL-2.0 license identifier to files with no license 2017-11-02 11:10:55 +01:00
Kconfig License cleanup: add SPDX GPL-2.0 license identifier to files with no license 2017-11-02 11:10:55 +01:00
MAINTAINERS MAINTAINERS: Add Sasha as a stable branch maintainer 2018-12-01 09:42:50 +01:00
Makefile Linux 4.14.148 2019-10-07 18:55:23 +02:00
README README: add a new README file, pointing to the Documentation/ 2016-10-24 08:12:35 -02:00

README 

Linux kernel
============

This file was moved to Documentation/admin-guide/README.rst

Please notice that there are several guides for kernel developers and users.
These guides can be rendered in a number of formats, like HTML and PDF.

In order to build the documentation, use ``make htmldocs`` or
``make pdfdocs``.

There are various text files in the Documentation/ subdirectory,
several of them using the Restructured Text markup notation.
See Documentation/00-INDEX for a list of what is contained in each file.

Please read the Documentation/process/changes.rst file, as it contains the
requirements for building and running the kernel, and information about
the problems which may result by upgrading your kernel.