From: Al Viro <viro@zeniv.linux.org.uk>
To: Rasmus Villemoes <linux@rasmusvillemoes.dk>
Cc: Andy Lutomirski <luto@kernel.org>,
syzbot <syzbot+ea3a78a71705faf41d77@syzkaller.appspotmail.com>,
Aleksa Sarai <cyphar@cyphar.com>, Borislav Petkov <bp@alien8.de>,
Dave Hansen <dave.hansen@linux.intel.com>,
"H. Peter Anvin" <hpa@zytor.com>,
LKML <linux-kernel@vger.kernel.org>,
Ingo Molnar <mingo@redhat.com>,
Peter Zijlstra <peterz@infradead.org>,
syzkaller-bugs@googlegroups.com,
Thomas Gleixner <tglx@linutronix.de>, X86 ML <x86@kernel.org>
Subject: Re: WARNING in ex_handler_uaccess
Date: Wed, 23 Sep 2020 05:26:05 +0100 [thread overview]
Message-ID: <20200923042605.GG3421308@ZenIV.linux.org.uk> (raw)
In-Reply-To: <bc5d889c-17f0-dcb8-d174-f21b321cf85b@rasmusvillemoes.dk>
On Mon, Sep 21, 2020 at 12:22:19PM +0200, Rasmus Villemoes wrote:
> So, not sure how the above got triggered, but I notice there might be an
> edge case in check_zeroed_user():
>
> from -= align;
> size += align;
>
> if (!user_read_access_begin(from, size))
> return -EFAULT;
>
> unsafe_get_user(val, (unsigned long __user *) from, err_fault);
>
>
> Suppose size is (size_t)-3 and align is 3. What's the convention for
> access_ok(whatever, 0)? Is that equivalent to access_ok(whatever, 1), or
> is it always true (or $ARCH-dependent)?
It's usually true...
> But, AFAICT, no current caller of check_zeroed_user can end up passing
> in a size that can overflow to 0. E.g. for the case at hand, size cannot
> be more than SIZE_MAX-24.
Might be worth slapping if (unlikely(!size)) return -EFAULT; // overflow
just before user_read_access_begin() to be sure...
prev parent reply other threads:[~2020-09-23 4:26 UTC|newest]
Thread overview: 9+ messages / expand[flat|nested] mbox.gz Atom feed top
2020-09-18 21:01 WARNING in ex_handler_uaccess syzbot
2020-09-18 23:31 ` Andy Lutomirski
2020-09-18 23:55 ` Al Viro
2020-09-19 0:07 ` Andy Lutomirski
2020-09-19 0:17 ` Al Viro
2020-09-19 15:37 ` David Laight
2020-09-21 10:22 ` Rasmus Villemoes
2020-09-21 10:33 ` David Laight
2020-09-23 4:26 ` Al Viro [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20200923042605.GG3421308@ZenIV.linux.org.uk \
--to=viro@zeniv.linux.org.uk \
--cc=bp@alien8.de \
--cc=cyphar@cyphar.com \
--cc=dave.hansen@linux.intel.com \
--cc=hpa@zytor.com \
--cc=linux-kernel@vger.kernel.org \
--cc=linux@rasmusvillemoes.dk \
--cc=luto@kernel.org \
--cc=mingo@redhat.com \
--cc=peterz@infradead.org \
--cc=syzbot+ea3a78a71705faf41d77@syzkaller.appspotmail.com \
--cc=syzkaller-bugs@googlegroups.com \
--cc=tglx@linutronix.de \
--cc=x86@kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox