From: jak@rudolph.ccur.com (Joe Korty)
To: trivial@rustcorp.com.au
Cc: linux-kernel@vger.kernel.org
Subject: [PATCH] some large create_module(2) sizes can oops a kernel
Date: Sat, 11 Jan 2003 21:41:36 -0500 (EST) [thread overview]
Message-ID: <200301120241.CAA16791@rudolph.ccur.com> (raw)
Hi Rusty aka trivial patch monkey, everyone,
The 2.4 kernel will oops when create_module(2) is passed a size of
-1, -2, or any size larger than num_physpages. The following patch
is one of the many simple ways to fix this. Please consider it or
some variant for inclusion in 2.4.
I mention this issue only because the kernel should not be panic-able
based on user input to system services.
This patch leaves unfixed the sparc64, x86_64, and generic
architectures. Only the i386 was tested.
Regards,
Joe
diff -ur 2.4.21-pre3/include/asm-alpha/module.h 2.4.21-pre3-jak/include/asm-alpha/module.h
--- 2.4.21-pre3/include/asm-alpha/module.h 2001-09-13 18:21:32.000000000 -0400
+++ 2.4.21-pre3-jak/include/asm-alpha/module.h 2003-01-11 20:51:39.000000000 -0500
@@ -4,7 +4,7 @@
* This file contains the alpha architecture specific module code.
*/
-#define module_map(x) vmalloc(x)
+#define module_map(x) (((size >> PAGE_SHIFT) > num_physpages) ? NULL : vmalloc(x))
#define module_unmap(x) vfree(x)
#define module_arch_init(x) alpha_module_init(x)
#define arch_init_modules(x) alpha_init_modules(x)
diff -ur 2.4.21-pre3/include/asm-arm/module.h 2.4.21-pre3-jak/include/asm-arm/module.h
--- 2.4.21-pre3/include/asm-arm/module.h 2001-09-13 19:33:03.000000000 -0400
+++ 2.4.21-pre3-jak/include/asm-arm/module.h 2003-01-11 20:51:39.000000000 -0500
@@ -4,7 +4,7 @@
* This file contains the arm architecture specific module code.
*/
-#define module_map(x) vmalloc(x)
+#define module_map(x) (((size >> PAGE_SHIFT) > num_physpages) ? NULL : vmalloc(x))
#define module_unmap(x) vfree(x)
#define module_arch_init(x) (0)
#define arch_init_modules(x) do { } while (0)
diff -ur 2.4.21-pre3/include/asm-cris/module.h 2.4.21-pre3-jak/include/asm-cris/module.h
--- 2.4.21-pre3/include/asm-cris/module.h 2001-10-08 14:43:54.000000000 -0400
+++ 2.4.21-pre3-jak/include/asm-cris/module.h 2003-01-11 20:51:39.000000000 -0500
@@ -4,7 +4,7 @@
* This file contains the CRIS architecture specific module code.
*/
-#define module_map(x) vmalloc(x)
+#define module_map(x) (((size >> PAGE_SHIFT) > num_physpages) ? NULL : vmalloc(x))
#define module_unmap(x) vfree(x)
#define module_arch_init(x) (0)
#define arch_init_modules(x) do { } while (0)
diff -ur 2.4.21-pre3/include/asm-i386/module.h 2.4.21-pre3-jak/include/asm-i386/module.h
--- 2.4.21-pre3/include/asm-i386/module.h 2001-09-13 19:33:03.000000000 -0400
+++ 2.4.21-pre3-jak/include/asm-i386/module.h 2003-01-11 20:51:39.000000000 -0500
@@ -4,7 +4,7 @@
* This file contains the i386 architecture specific module code.
*/
-#define module_map(x) vmalloc(x)
+#define module_map(x) (((size >> PAGE_SHIFT) > num_physpages) ? NULL : vmalloc(x))
#define module_unmap(x) vfree(x)
#define module_arch_init(x) (0)
#define arch_init_modules(x) do { } while (0)
Only in 2.4.21-pre3-jak/include/asm-i386: module.h.orig
diff -ur 2.4.21-pre3/include/asm-ia64/module.h 2.4.21-pre3-jak/include/asm-ia64/module.h
--- 2.4.21-pre3/include/asm-ia64/module.h 2002-11-28 18:53:15.000000000 -0500
+++ 2.4.21-pre3-jak/include/asm-ia64/module.h 2003-01-11 20:51:39.000000000 -0500
@@ -11,7 +11,7 @@
#include <linux/vmalloc.h>
#include <asm/unwind.h>
-#define module_map(x) vmalloc(x)
+#define module_map(x) (((size >> PAGE_SHIFT) > num_physpages) ? NULL : vmalloc(x))
#define module_unmap(x) ia64_module_unmap(x)
#define module_arch_init(x) ia64_module_init(x)
diff -ur 2.4.21-pre3/include/asm-m68k/module.h 2.4.21-pre3-jak/include/asm-m68k/module.h
--- 2.4.21-pre3/include/asm-m68k/module.h 2001-09-13 19:33:03.000000000 -0400
+++ 2.4.21-pre3-jak/include/asm-m68k/module.h 2003-01-11 20:51:39.000000000 -0500
@@ -4,7 +4,7 @@
* This file contains the m68k architecture specific module code.
*/
-#define module_map(x) vmalloc(x)
+#define module_map(x) (((size >> PAGE_SHIFT) > num_physpages) ? NULL : vmalloc(x))
#define module_unmap(x) vfree(x)
#define module_arch_init(x) (0)
#define arch_init_modules(x) do { } while (0)
diff -ur 2.4.21-pre3/include/asm-mips/module.h 2.4.21-pre3-jak/include/asm-mips/module.h
--- 2.4.21-pre3/include/asm-mips/module.h 2001-09-09 13:43:01.000000000 -0400
+++ 2.4.21-pre3-jak/include/asm-mips/module.h 2003-01-11 20:51:39.000000000 -0500
@@ -7,7 +7,7 @@
#include <linux/module.h>
#include <asm/uaccess.h>
-#define module_map(x) vmalloc(x)
+#define module_map(x) (((size >> PAGE_SHIFT) > num_physpages) ? NULL : vmalloc(x))
#define module_unmap(x) vfree(x)
#define module_arch_init(x) mips_module_init(x)
#define arch_init_modules(x) mips_init_modules(x)
diff -ur 2.4.21-pre3/include/asm-mips64/module.h 2.4.21-pre3-jak/include/asm-mips64/module.h
--- 2.4.21-pre3/include/asm-mips64/module.h 2001-09-09 13:43:02.000000000 -0400
+++ 2.4.21-pre3-jak/include/asm-mips64/module.h 2003-01-11 20:51:39.000000000 -0500
@@ -7,7 +7,7 @@
#include <linux/module.h>
#include <asm/uaccess.h>
-#define module_map(x) vmalloc(x)
+#define module_map(x) (((size >> PAGE_SHIFT) > num_physpages) ? NULL : vmalloc(x))
#define module_unmap(x) vfree(x)
#define module_arch_init(x) mips64_module_init(x)
#define arch_init_modules(x) mips64_init_modules(x)
diff -ur 2.4.21-pre3/include/asm-parisc/module.h 2.4.21-pre3-jak/include/asm-parisc/module.h
--- 2.4.21-pre3/include/asm-parisc/module.h 2002-11-28 18:53:15.000000000 -0500
+++ 2.4.21-pre3-jak/include/asm-parisc/module.h 2003-01-11 20:51:39.000000000 -0500
@@ -4,7 +4,7 @@
* This file contains the parisc architecture specific module code.
*/
-#define module_map(x) vmalloc(x)
+#define module_map(x) (((size >> PAGE_SHIFT) > num_physpages) ? NULL : vmalloc(x))
#define module_unmap(x) vfree(x)
#define module_arch_init(x) (0)
#define arch_init_modules(x) do { } while (0)
diff -ur 2.4.21-pre3/include/asm-ppc/module.h 2.4.21-pre3-jak/include/asm-ppc/module.h
--- 2.4.21-pre3/include/asm-ppc/module.h 2001-09-13 19:33:03.000000000 -0400
+++ 2.4.21-pre3-jak/include/asm-ppc/module.h 2003-01-11 20:51:39.000000000 -0500
@@ -7,7 +7,7 @@
* This file contains the PPC architecture specific module code.
*/
-#define module_map(x) vmalloc(x)
+#define module_map(x) (((size >> PAGE_SHIFT) > num_physpages) ? NULL : vmalloc(x))
#define module_unmap(x) vfree(x)
#define module_arch_init(x) (0)
#define arch_init_modules(x) do { } while (0)
diff -ur 2.4.21-pre3/include/asm-ppc64/module.h 2.4.21-pre3-jak/include/asm-ppc64/module.h
--- 2.4.21-pre3/include/asm-ppc64/module.h 2002-08-02 20:39:45.000000000 -0400
+++ 2.4.21-pre3-jak/include/asm-ppc64/module.h 2003-01-11 20:51:39.000000000 -0500
@@ -11,7 +11,7 @@
* 2 of the License, or (at your option) any later version.
*/
-#define module_map(x) vmalloc(x)
+#define module_map(x) (((size >> PAGE_SHIFT) > num_physpages) ? NULL : vmalloc(x))
#define module_unmap(x) vfree(x)
#define arch_init_modules(x) do { } while (0)
#define module_arch_init(x) (0)
diff -ur 2.4.21-pre3/include/asm-s390/module.h 2.4.21-pre3-jak/include/asm-s390/module.h
--- 2.4.21-pre3/include/asm-s390/module.h 2001-09-13 19:33:03.000000000 -0400
+++ 2.4.21-pre3-jak/include/asm-s390/module.h 2003-01-11 20:51:39.000000000 -0500
@@ -4,7 +4,7 @@
* This file contains the s390 architecture specific module code.
*/
-#define module_map(x) vmalloc(x)
+#define module_map(x) (((size >> PAGE_SHIFT) > num_physpages) ? NULL : vmalloc(x))
#define module_unmap(x) vfree(x)
#define module_arch_init(x) (0)
#define arch_init_modules(x) do { } while (0)
diff -ur 2.4.21-pre3/include/asm-s390x/module.h 2.4.21-pre3-jak/include/asm-s390x/module.h
--- 2.4.21-pre3/include/asm-s390x/module.h 2001-09-13 19:33:03.000000000 -0400
+++ 2.4.21-pre3-jak/include/asm-s390x/module.h 2003-01-11 20:51:40.000000000 -0500
@@ -4,7 +4,7 @@
* This file contains the s390 architecture specific module code.
*/
-#define module_map(x) vmalloc(x)
+#define module_map(x) (((size >> PAGE_SHIFT) > num_physpages) ? NULL : vmalloc(x))
#define module_unmap(x) vfree(x)
#define module_arch_init(x) (0)
#define arch_init_modules(x) do { } while (0)
diff -ur 2.4.21-pre3/include/asm-sh/module.h 2.4.21-pre3-jak/include/asm-sh/module.h
--- 2.4.21-pre3/include/asm-sh/module.h 2001-09-13 19:33:03.000000000 -0400
+++ 2.4.21-pre3-jak/include/asm-sh/module.h 2003-01-11 20:51:40.000000000 -0500
@@ -4,7 +4,7 @@
* This file contains the SH architecture specific module code.
*/
-#define module_map(x) vmalloc(x)
+#define module_map(x) (((size >> PAGE_SHIFT) > num_physpages) ? NULL : vmalloc(x))
#define module_unmap(x) vfree(x)
#define module_arch_init(x) (0)
#define arch_init_modules(x) do { } while (0)
diff -ur 2.4.21-pre3/include/asm-sparc/module.h 2.4.21-pre3-jak/include/asm-sparc/module.h
--- 2.4.21-pre3/include/asm-sparc/module.h 2001-09-13 19:33:03.000000000 -0400
+++ 2.4.21-pre3-jak/include/asm-sparc/module.h 2003-01-11 20:51:40.000000000 -0500
@@ -4,7 +4,7 @@
* This file contains the sparc architecture specific module code.
*/
-#define module_map(x) vmalloc(x)
+#define module_map(x) (((size >> PAGE_SHIFT) > num_physpages) ? NULL : vmalloc(x))
#define module_unmap(x) vfree(x)
#define module_arch_init(x) (0)
#define arch_init_modules(x) do { } while (0)
next reply other threads:[~2003-01-12 2:33 UTC|newest]
Thread overview: 3+ messages / expand[flat|nested] mbox.gz Atom feed top
2003-01-12 2:41 Joe Korty [this message]
2003-01-13 2:34 ` [PATCH] some large create_module(2) sizes can oops a kernel Rusty Russell
2003-01-13 3:59 ` Joe Korty
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=200301120241.CAA16791@rudolph.ccur.com \
--to=jak@rudolph.ccur.com \
--cc=joe.korty@ccur.com \
--cc=linux-kernel@vger.kernel.org \
--cc=trivial@rustcorp.com.au \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox