From: Oleg Nesterov <oleg@redhat.com>
To: Manfred Spraul <manfred@colorfullife.com>
Cc: Andrew Morton <akpm@linux-foundation.org>,
Hugh Dickins <hughd@google.com>,
Cyrill Gorcunov <gorcunov@openvz.org>,
Davidlohr Bueso <davidlohr.bueso@hp.com>,
Kees Cook <keescook@chromium.org>, Tejun Heo <tj@kernel.org>,
Andrew Vagin <avagin@openvz.org>,
"Eric W. Biederman" <ebiederm@xmission.com>,
"H. Peter Anvin" <hpa@zytor.com>,
Serge Hallyn <serge.hallyn@canonical.com>,
Pavel Emelyanov <xemul@parallels.com>,
Vasiliy Kulikov <segoon@openwall.com>,
KAMEZAWA Hiroyuki <kamezawa.hiroyu@jp.fujitsu.com>,
Michael Kerrisk <mtk.manpages@gmail.com>,
Julien Tinnes <jln@google.com>,
linux-kernel@vger.kernel.org
Subject: Re: [PATCH 1/1] ipc/shm: fix the historical/wrong mm->start_stack check
Date: Mon, 25 Aug 2014 16:53:41 +0200 [thread overview]
Message-ID: <20140825145341.GA3021@redhat.com> (raw)
In-Reply-To: <53FA23E5.5010603@colorfullife.com>
On 08/24, Manfred Spraul wrote:
>
> On 08/23/2014 04:43 PM, Oleg Nesterov wrote:
>> The ->start_stack check in do_shmat() looks ugly and simply wrong.
>>
>> 1. ->start_stack is only valid right after exec(), the application
>> can switch to another stack and even unmap this area.
>>
>> 2. The reason for this check is not clear at all. The application
>> should know what it does. And why 4 pages? And why in fact it
>> requires 5 pages?
>>
>> 3. This wrongly assumes that the stack can only grown down.
>>
>> Personally I think we should simply kill this check, but I did not
>> dare to do this. So the patch only fixes the 1st problem (mostly to
>> avoid the usage of mm->start_stack) and ignores VM_GROWSUP.
>>
>> Signed-off-by: Oleg Nesterov <oleg@redhat.com>
> Acked-by: Manfred Spraul <manfred@colorfullife.com>
Thanks!
>> + if (vma) {
>> + if (vma->vm_flags & VM_GROWSDOWN)
>> + end += PAGE_SIZE * 4; /* can't overflow */
> Why is an overflow impossible?
OOPS. I swear it was not possible until I simplified this patch ;)
In fact we do not really care because do_mmap_pgoff() will fail, but
this should be fixed anyway. Either we should not check the overflows
at all, or these checks should be consistent.
I'll send v2, thanks Manfred.
Oleg.
next prev parent reply other threads:[~2014-08-25 14:56 UTC|newest]
Thread overview: 19+ messages / expand[flat|nested] mbox.gz Atom feed top
2014-08-23 14:42 [PATCH 0/1] ipc/shm: fix the historical/wrong mm->start_stack check Oleg Nesterov
2014-08-23 14:43 ` [PATCH 1/1] " Oleg Nesterov
2014-08-23 15:22 ` Cyrill Gorcunov
2014-08-23 15:58 ` Oleg Nesterov
2014-08-25 1:38 ` Hugh Dickins
2014-08-25 15:03 ` Oleg Nesterov
2014-08-25 16:18 ` Hugh Dickins
2014-08-25 17:18 ` Oleg Nesterov
2014-08-25 18:51 ` Hugh Dickins
2014-08-25 19:09 ` Oleg Nesterov
2014-08-24 17:41 ` Manfred Spraul
2014-08-25 14:53 ` Oleg Nesterov [this message]
2014-08-25 19:12 ` [PATCH v2] " Oleg Nesterov
2014-08-25 21:22 ` Cyrill Gorcunov
2014-08-26 19:37 ` Oleg Nesterov
2014-08-25 21:49 ` Hugh Dickins
2014-08-26 14:32 ` Oleg Nesterov
2014-08-26 19:31 ` [PATCH v3] ipc/shm: kill " Oleg Nesterov
2014-08-26 20:28 ` Hugh Dickins
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20140825145341.GA3021@redhat.com \
--to=oleg@redhat.com \
--cc=akpm@linux-foundation.org \
--cc=avagin@openvz.org \
--cc=davidlohr.bueso@hp.com \
--cc=ebiederm@xmission.com \
--cc=gorcunov@openvz.org \
--cc=hpa@zytor.com \
--cc=hughd@google.com \
--cc=jln@google.com \
--cc=kamezawa.hiroyu@jp.fujitsu.com \
--cc=keescook@chromium.org \
--cc=linux-kernel@vger.kernel.org \
--cc=manfred@colorfullife.com \
--cc=mtk.manpages@gmail.com \
--cc=segoon@openwall.com \
--cc=serge.hallyn@canonical.com \
--cc=tj@kernel.org \
--cc=xemul@parallels.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox