LKML Archive on lore.kernel.org
help / color / mirror / Atom feed
From: Greg KH <gregkh@suse.de>
To: linux-kernel@vger.kernel.org, stable@kernel.org
Cc: Justin Forbes <jmforbes@linuxtx.org>,
	Zwane Mwaikambo <zwane@arm.linux.org.uk>,
	"Theodore Ts'o" <tytso@mit.edu>,
	Randy Dunlap <rdunlap@xenotime.net>,
	Dave Jones <davej@redhat.com>,
	Chuck Wolber <chuckw@quantumlinux.com>,
	Chris Wedgwood <reviews@ml.cw.f00f.org>,
	Michael Krufky <mkrufky@linuxtv.org>,
	Chuck Ebbert <cebbert@redhat.com>,
	Domenico Andreoli <cavokz@gmail.com>,
	torvalds@linux-foundation.org, akpm@linux-foundation.org,
	alan@lxorguk.ukuu.org.uk, Nick Piggin <npiggin@suse.de>
Subject: [patch 03/45] vm audit: add VM_DONTEXPAND to mmap for drivers that need it (CVE-2008-0007)
Date: Thu, 7 Feb 2008 12:46:25 -0800	[thread overview]
Message-ID: <20080207204625.GD16389@suse.de> (raw)
In-Reply-To: <20080207204549.GA16389@suse.de>

[-- Attachment #1: vm-audit-add-vm_dontexpand-to-mmap-for-drivers-that-need-it.patch --]
[-- Type: text/plain, Size: 4717 bytes --]

2.6.24-stable review patch.  If anyone has any objections, please let us know.

------------------
From: Nick Piggin <npiggin@suse.de>

Drivers that register a ->fault handler, but do not range-check the
offset argument, must set VM_DONTEXPAND in the vm_flags in order to
prevent an expanding mremap from overflowing the resource.

I've audited the tree and attempted to fix these problems (usually by
adding VM_DONTEXPAND where it is not obvious).

Signed-off-by: Nick Piggin <npiggin@suse.de>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

---
 drivers/char/drm/drm_vm.c       |    2 ++
 drivers/char/mspec.c            |    2 +-
 fs/ncpfs/mmap.c                 |    4 ----
 kernel/relay.c                  |    1 +
 mm/mmap.c                       |    2 +-
 sound/oss/via82cxxx_audio.c     |   14 ++++++--------
 sound/usb/usx2y/usX2Yhwdep.c    |    2 +-
 sound/usb/usx2y/usx2yhwdeppcm.c |    2 +-
 8 files changed, 13 insertions(+), 16 deletions(-)

--- a/drivers/char/drm/drm_vm.c
+++ b/drivers/char/drm/drm_vm.c
@@ -506,6 +506,7 @@ static int drm_mmap_dma(struct file *fil
 	vma->vm_ops = &drm_vm_dma_ops;
 
 	vma->vm_flags |= VM_RESERVED;	/* Don't swap */
+	vma->vm_flags |= VM_DONTEXPAND;
 
 	vma->vm_file = filp;	/* Needed for drm_vm_open() */
 	drm_vm_open_locked(vma);
@@ -655,6 +656,7 @@ static int drm_mmap_locked(struct file *
 		return -EINVAL;	/* This should never happen. */
 	}
 	vma->vm_flags |= VM_RESERVED;	/* Don't swap */
+	vma->vm_flags |= VM_DONTEXPAND;
 
 	vma->vm_file = filp;	/* Needed for drm_vm_open() */
 	drm_vm_open_locked(vma);
--- a/drivers/char/mspec.c
+++ b/drivers/char/mspec.c
@@ -283,7 +283,7 @@ mspec_mmap(struct file *file, struct vm_
 	vdata->refcnt = ATOMIC_INIT(1);
 	vma->vm_private_data = vdata;
 
-	vma->vm_flags |= (VM_IO | VM_RESERVED | VM_PFNMAP);
+	vma->vm_flags |= (VM_IO | VM_RESERVED | VM_PFNMAP | VM_DONTEXPAND);
 	if (vdata->type == MSPEC_FETCHOP || vdata->type == MSPEC_UNCACHED)
 		vma->vm_page_prot = pgprot_noncached(vma->vm_page_prot);
 	vma->vm_ops = &mspec_vm_ops;
--- a/fs/ncpfs/mmap.c
+++ b/fs/ncpfs/mmap.c
@@ -50,10 +50,6 @@ static int ncp_file_mmap_fault(struct vm
 	pos = vmf->pgoff << PAGE_SHIFT;
 
 	count = PAGE_SIZE;
-	if ((unsigned long)vmf->virtual_address + PAGE_SIZE > area->vm_end) {
-		WARN_ON(1); /* shouldn't happen? */
-		count = area->vm_end - (unsigned long)vmf->virtual_address;
-	}
 	/* what we can read in one go */
 	bufsize = NCP_SERVER(inode)->buffer_size;
 
--- a/kernel/relay.c
+++ b/kernel/relay.c
@@ -92,6 +92,7 @@ static int relay_mmap_buf(struct rchan_b
 		return -EINVAL;
 
 	vma->vm_ops = &relay_file_mmap_ops;
+	vma->vm_flags |= VM_DONTEXPAND;
 	vma->vm_private_data = buf;
 	buf->chan->cb->buf_mapped(buf, filp);
 
--- a/mm/mmap.c
+++ b/mm/mmap.c
@@ -2215,7 +2215,7 @@ int install_special_mapping(struct mm_st
 	vma->vm_start = addr;
 	vma->vm_end = addr + len;
 
-	vma->vm_flags = vm_flags | mm->def_flags;
+	vma->vm_flags = vm_flags | mm->def_flags | VM_DONTEXPAND;
 	vma->vm_page_prot = vm_get_page_prot(vma->vm_flags);
 
 	vma->vm_ops = &special_mapping_vmops;
--- a/sound/oss/via82cxxx_audio.c
+++ b/sound/oss/via82cxxx_audio.c
@@ -2104,6 +2104,7 @@ static struct page * via_mm_nopage (stru
 {
 	struct via_info *card = vma->vm_private_data;
 	struct via_channel *chan = &card->ch_out;
+	unsigned long max_bufs;
 	struct page *dmapage;
 	unsigned long pgoff;
 	int rd, wr;
@@ -2127,14 +2128,11 @@ static struct page * via_mm_nopage (stru
 	rd = card->ch_in.is_mapped;
 	wr = card->ch_out.is_mapped;
 
-#ifndef VIA_NDEBUG
-	{
-	unsigned long max_bufs = chan->frag_number;
-	if (rd && wr) max_bufs *= 2;
-	/* via_dsp_mmap() should ensure this */
-	assert (pgoff < max_bufs);
-	}
-#endif
+	max_bufs = chan->frag_number;
+	if (rd && wr)
+		max_bufs *= 2;
+	if (pgoff >= max_bufs)
+		return NOPAGE_SIGBUS;
 
 	/* if full-duplex (read+write) and we have two sets of bufs,
 	 * then the playback buffers come first, sez soundcard.c */
--- a/sound/usb/usx2y/usX2Yhwdep.c
+++ b/sound/usb/usx2y/usX2Yhwdep.c
@@ -88,7 +88,7 @@ static int snd_us428ctls_mmap(struct snd
 		us428->us428ctls_sharedmem->CtlSnapShotLast = -2;
 	}
 	area->vm_ops = &us428ctls_vm_ops;
-	area->vm_flags |= VM_RESERVED;
+	area->vm_flags |= VM_RESERVED | VM_DONTEXPAND;
 	area->vm_private_data = hw->private_data;
 	return 0;
 }
--- a/sound/usb/usx2y/usx2yhwdeppcm.c
+++ b/sound/usb/usx2y/usx2yhwdeppcm.c
@@ -728,7 +728,7 @@ static int snd_usX2Y_hwdep_pcm_mmap(stru
 		return -ENODEV;
 	}
 	area->vm_ops = &snd_usX2Y_hwdep_pcm_vm_ops;
-	area->vm_flags |= VM_RESERVED;
+	area->vm_flags |= VM_RESERVED | VM_DONTEXPAND;
 	area->vm_private_data = hw->private_data;
 	return 0;
 }

-- 

  parent reply	other threads:[~2008-02-07 20:52 UTC|newest]

Thread overview: 64+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
     [not found] <20080207204118.202098927@mini.kroah.org>
2008-02-07 20:45 ` [patch 00/45] 2.6.24-stable review Greg KH
2008-02-07 20:46   ` [patch 01/45] DVB: cx23885: add missing subsystem ID for Hauppauge HVR1800 Retail Greg KH
2008-02-07 20:46   ` [patch 02/45] slab: fix bootstrap on memoryless node Greg KH
2008-02-07 20:46   ` Greg KH [this message]
2008-02-07 20:46   ` [patch 04/45] USB: keyspan: Fix oops Greg KH
2008-02-07 20:46   ` [patch 05/45] usb gadget: fix fsl_usb2_udc potential OOPS Greg KH
2008-02-07 20:46   ` [patch 06/45] USB: CP2101 New Device IDs Greg KH
2008-02-07 20:46   ` [patch 07/45] USB: add support for 4348:5523 WinChipHead USB->RS 232 adapter Greg KH
2008-02-07 20:46   ` [patch 08/45] USB: Sierra - Add support for Aircard 881U Greg KH
2008-02-07 20:46   ` [patch 09/45] USB: Adding YC Cable USB Serial device to pl2303 Greg KH
2008-02-07 20:47   ` [patch 10/45] USB: sierra driver - add devices Greg KH
2008-02-07 20:47   ` [patch 11/45] USB: ftdi_sio - enabling multiple ELV devices, adding EM1010PC Greg KH
2008-02-07 20:47   ` [patch 12/45] USB: ftdi-sio: Patch to add vendor/device id for ATK_16IC CCD Greg KH
2008-02-07 20:47   ` [patch 13/45] USB: sierra: add support for Onda H600/Zte MF330 datacard to USB Driver for Sierra Wireless Greg KH
2008-02-08  2:21     ` [patch 13/45] USB: sierra: add support for Onda H600/Zte MF330datacard " Kevin Lloyd
2008-02-08  4:11       ` Greg KH
2008-02-08 16:50         ` [patch 13/45] USB: sierra: add support for Onda H600/ZteMF330datacard " Kevin Lloyd
2008-02-08 18:47           ` Greg KH
2008-02-07 20:47   ` [patch 14/45] USB: remove duplicate entry in Option driver and Pl2303 driver for Huawei modem Greg KH
2008-02-07 20:47   ` [patch 15/45] USB: pl2303: add support for RATOC REX-USB60F Greg KH
2008-02-07 20:47   ` [patch 16/45] USB: ftdi driver - add support for optical probe device Greg KH
2008-02-07 20:47   ` [patch 17/45] USB: use GFP_NOIO in reset path Greg KH
2008-02-07 20:47   ` [patch 18/45] USB: Variant of the Dell Wireless 5520 driver Greg KH
2008-02-07 20:47   ` [patch 19/45] USB: storage: Add unusual_dev for HP r707 Greg KH
2008-02-07 20:47   ` [patch 20/45] USB: fix usbtest halt check on big endian systems Greg KH
2008-02-07 20:47   ` [patch 21/45] USB: handle idVendor of 0x0000 Greg KH
2008-02-07 20:47   ` [patch 22/45] USB: Fix usb_serial_driver structure for Kobil cardreader driver Greg KH
2008-02-07 20:47   ` [patch 23/45] forcedeth: mac address mcp77/79 Greg KH
2008-02-07 20:47   ` [patch 24/45] lockdep: annotate epoll Greg KH
2008-02-07 20:47   ` [patch 25/45] sys_remap_file_pages: fix ->vm_file accounting Greg KH
2008-02-07 20:47   ` [patch 26/45] PCI: Fix fakephp deadlock Greg KH
2008-02-07 20:47   ` [patch 27/45] ACPI: update ACPI blacklist Greg KH
2008-02-07 20:47   ` [patch 28/45] x86: restore correct module name for apm Greg KH
2008-02-07 20:47   ` [patch 29/45] sky2: restore multicast addresses after recovery Greg KH
2008-02-07 20:47   ` [patch 30/45] sky2: fix for WOL on some devices Greg KH
2008-02-07 20:47   ` [patch 31/45] b43: Fix suspend/resume Greg KH
2008-02-07 20:47   ` [patch 32/45] b43: Drop packets we are not able to encrypt Greg KH
2008-02-07 20:47   ` [patch 33/45] b43: Fix dma-slot resource leakage Greg KH
2008-02-07 20:47   ` [patch 34/45] b43legacy: fix PIO crash Greg KH
2008-02-07 20:48   ` [patch 35/45] b43legacy: fix suspend/resume Greg KH
2008-02-07 20:48   ` [patch 36/45] b43legacy: drop packets we are not able to encrypt Greg KH
2008-02-07 20:48   ` [patch 37/45] b43legacy: fix DMA slot resource leakage Greg KH
2008-02-07 20:48   ` [patch 38/45] selinux: fix labeling of /proc/net inodes Greg KH
2008-02-07 20:48   ` [patch 39/45] b43: Reject new firmware early Greg KH
2008-02-07 20:48   ` [patch 40/45] sched: let +nice tasks have smaller impact Greg KH
2008-02-07 20:48   ` [patch 41/45] sched: fix high wake up latencies with FAIR_USER_SCHED Greg KH
2008-02-07 20:48   ` [patch 42/45] fix writev regression: pan hanging unkillable and un-straceable Greg KH
2008-02-07 20:48   ` [patch 43/45] x86: replace LOCK_PREFIX in futex.h Greg KH
2008-02-08 18:35     ` Stefan Lippers-Hollmann
2008-02-08 19:19       ` Greg KH
2008-02-08 21:45       ` Chuck Ebbert
2008-02-07 20:48   ` [patch 44/45] Driver core: Revert "Fix Firmware class name collision" Greg KH
2008-02-07 20:48   ` [patch 45/45] drm: the drm really should call pci_set_master Greg KH
2008-02-07 21:41   ` [patch 00/45] 2.6.24-stable review S.Çağlar Onur
2008-02-07 21:58     ` Greg KH
2008-02-09  0:57       ` [stable] " Greg KH
2008-02-07 23:50   ` Chuck Ebbert
2008-02-08  1:32     ` [stable] " Greg KH
2008-02-08  0:44   ` David Chinner
2008-02-08  1:12     ` [stable] " Greg KH
2008-02-08  1:24       ` David Chinner
2008-02-08  1:35         ` Greg KH
2008-02-08 22:26           ` [PATCH] stable_kernel_rules: fix must already be in mainline Stefan Richter
2008-02-08  5:31   ` [stable] [patch 00/45] 2.6.24-stable review Greg KH

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20080207204625.GD16389@suse.de \
    --to=gregkh@suse.de \
    --cc=akpm@linux-foundation.org \
    --cc=alan@lxorguk.ukuu.org.uk \
    --cc=cavokz@gmail.com \
    --cc=cebbert@redhat.com \
    --cc=chuckw@quantumlinux.com \
    --cc=davej@redhat.com \
    --cc=jmforbes@linuxtx.org \
    --cc=linux-kernel@vger.kernel.org \
    --cc=mkrufky@linuxtv.org \
    --cc=npiggin@suse.de \
    --cc=rdunlap@xenotime.net \
    --cc=reviews@ml.cw.f00f.org \
    --cc=stable@kernel.org \
    --cc=torvalds@linux-foundation.org \
    --cc=tytso@mit.edu \
    --cc=zwane@arm.linux.org.uk \
    --subject='Re: [patch 03/45] vm audit: add VM_DONTEXPAND to mmap for drivers that need it (CVE-2008-0007)' \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).