TWxSoftware/twx-linux
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
fa3fc2ad99
twx-linux/drivers
History
Kirill A. Shutemov bfd40eaff5 mm: fix vma_is_anonymous() false-positives 
vma_is_anonymous() relies on ->vm_ops being NULL to detect anonymous
VMA.  This is unreliable as ->mmap may not set ->vm_ops.

False-positive vma_is_anonymous() may lead to crashes:

	next ffff8801ce5e7040 prev ffff8801d20eca50 mm ffff88019c1e13c0
	prot 27 anon_vma ffff88019680cdd8 vm_ops 0000000000000000
	pgoff 0 file ffff8801b2ec2d00 private_data 0000000000000000
	flags: 0xff(read|write|exec|shared|mayread|maywrite|mayexec|mayshare)
	------------[ cut here ]------------
	kernel BUG at mm/memory.c:1422!
	invalid opcode: 0000 [#1] SMP KASAN
	CPU: 0 PID: 18486 Comm: syz-executor3 Not tainted 4.18.0-rc3+ #136
	Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google
	01/01/2011
	RIP: 0010:zap_pmd_range mm/memory.c:1421 [inline]
	RIP: 0010:zap_pud_range mm/memory.c:1466 [inline]
	RIP: 0010:zap_p4d_range mm/memory.c:1487 [inline]
	RIP: 0010:unmap_page_range+0x1c18/0x2220 mm/memory.c:1508
	Call Trace:
	 unmap_single_vma+0x1a0/0x310 mm/memory.c:1553
	 zap_page_range_single+0x3cc/0x580 mm/memory.c:1644
	 unmap_mapping_range_vma mm/memory.c:2792 [inline]
	 unmap_mapping_range_tree mm/memory.c:2813 [inline]
	 unmap_mapping_pages+0x3a7/0x5b0 mm/memory.c:2845
	 unmap_mapping_range+0x48/0x60 mm/memory.c:2880
	 truncate_pagecache+0x54/0x90 mm/truncate.c:800
	 truncate_setsize+0x70/0xb0 mm/truncate.c:826
	 simple_setattr+0xe9/0x110 fs/libfs.c:409
	 notify_change+0xf13/0x10f0 fs/attr.c:335
	 do_truncate+0x1ac/0x2b0 fs/open.c:63
	 do_sys_ftruncate+0x492/0x560 fs/open.c:205
	 __do_sys_ftruncate fs/open.c:215 [inline]
	 __se_sys_ftruncate fs/open.c:213 [inline]
	 __x64_sys_ftruncate+0x59/0x80 fs/open.c:213
	 do_syscall_64+0x1b9/0x820 arch/x86/entry/common.c:290
	 entry_SYSCALL_64_after_hwframe+0x49/0xbe

Reproducer:

	#include <stdio.h>
	#include <stddef.h>
	#include <stdint.h>
	#include <stdlib.h>
	#include <string.h>
	#include <sys/types.h>
	#include <sys/stat.h>
	#include <sys/ioctl.h>
	#include <sys/mman.h>
	#include <unistd.h>
	#include <fcntl.h>

	#define KCOV_INIT_TRACE			_IOR('c', 1, unsigned long)
	#define KCOV_ENABLE			_IO('c', 100)
	#define KCOV_DISABLE			_IO('c', 101)
	#define COVER_SIZE			(1024<<10)

	#define KCOV_TRACE_PC  0
	#define KCOV_TRACE_CMP 1

	int main(int argc, char **argv)
	{
		int fd;
		unsigned long *cover;

		system("mount -t debugfs none /sys/kernel/debug");
		fd = open("/sys/kernel/debug/kcov", O_RDWR);
		ioctl(fd, KCOV_INIT_TRACE, COVER_SIZE);
		cover = mmap(NULL, COVER_SIZE * sizeof(unsigned long),
				PROT_READ | PROT_WRITE, MAP_SHARED, fd, 0);
		munmap(cover, COVER_SIZE * sizeof(unsigned long));
		cover = mmap(NULL, COVER_SIZE * sizeof(unsigned long),
				PROT_READ | PROT_WRITE, MAP_PRIVATE, fd, 0);
		memset(cover, 0, COVER_SIZE * sizeof(unsigned long));
		ftruncate(fd, 3UL << 20);
		return 0;
	}

This can be fixed by assigning anonymous VMAs own vm_ops and not relying
on it being NULL.

If ->mmap() failed to set ->vm_ops, mmap_region() will set it to
dummy_vm_ops.  This way we will have non-NULL ->vm_ops for all VMAs.

Link: http://lkml.kernel.org/r/20180724121139.62570-4-kirill.shutemov@linux.intel.com
Signed-off-by: Kirill A. Shutemov <kirill.shutemov@linux.intel.com>
Reported-by: syzbot+3f84280d52be9b7083cc@syzkaller.appspotmail.com
Acked-by: Linus Torvalds <torvalds@linux-foundation.org>
Reviewed-by: Andrew Morton <akpm@linux-foundation.org>
Cc: Dmitry Vyukov <dvyukov@google.com>
Cc: Oleg Nesterov <oleg@redhat.com>
Cc: Andrea Arcangeli <aarcange@redhat.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
2018-07-26 19:38:03 -07:00
..
accessibility
acpi ACPICA: AML Parser: ignore dispatcher error status during table load 2018-07-23 13:39:33 +02:00
amba Merge branch 'for-linus' of git://git.armlinux.org.uk/~rmk/linux-arm 2018-06-06 13:49:25 -07:00
android treewide: kzalloc() -> kcalloc() 2018-06-12 16:19:22 -07:00
ata ata: Remove depends on HAS_DMA in case of platform dependency 2018-07-02 13:18:22 -07:00
atm atm: zatm: Fix potential Spectre v1 2018-06-30 21:24:18 +09:00
auxdisplay treewide: kmalloc() -> kmalloc_array() 2018-06-12 16:19:22 -07:00
base Driver core fixes for 4.18-rc7 2018-07-26 09:25:03 -07:00
bcma
block for-linus-20180706 2018-07-06 19:13:42 -07:00
bluetooth bluetooth: hci_nokia: Don't include linux/unaligned/le_struct.h directly. 2018-06-17 08:38:55 +09:00
bus bus: ti-sysc: Use 2-factor allocator arguments 2018-07-02 04:24:44 -07:00
cdrom treewide: kmalloc() -> kmalloc_array() 2018-06-12 16:19:22 -07:00
char mm: fix vma_is_anonymous() false-positives 2018-07-26 19:38:03 -07:00
clk clk: aspeed: Support HPLL strapping on ast2400 2018-07-11 09:34:25 -07:00
clocksource clocksource: arm_arch_timer: Set arch_mem_timer cpumask to cpu_possible_mask 2018-07-10 22:12:47 +02:00
connector Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-next 2018-06-06 18:39:49 -07:00
cpufreq cpufreq: qcom-kryo: add NULL entry to the end of_device_id array 2018-07-24 10:44:57 +02:00
cpuidle powerpc updates for 4.18 2018-06-07 10:23:33 -07:00
crypto Merge branch 'linus' of git://git.kernel.org/pub/scm/linux/kernel/git/herbert/crypto-2.6 2018-06-24 06:31:54 +08:00
dax * fix one ensures that a variable passed in by reference to 2018-07-13 10:54:01 -07:00
dca
devfreq treewide: devm_kzalloc() -> devm_kcalloc() 2018-06-12 16:19:22 -07:00
dio
dma dmaengine: k3dma: Off by one in k3_of_dma_simple_xlate() 2018-06-28 11:57:21 +05:30
dma-buf
edac treewide: kzalloc() -> kcalloc() 2018-06-12 16:19:22 -07:00
eisa
extcon treewide: kzalloc() -> kcalloc() 2018-06-12 16:19:22 -07:00
firewire treewide: kmalloc() -> kmalloc_array() 2018-06-12 16:19:22 -07:00
firmware efi/libstub/tpm: Initialize efi_physical_addr_t vars to zero for mixed mode 2018-06-22 10:58:27 +02:00
fmc treewide: kzalloc() -> kcalloc() 2018-06-12 16:19:22 -07:00
fpga fpga: altera-cvp: Fix an error handling path in 'altera_cvp_probe()' 2018-07-07 16:55:22 +02:00
fsi
gpio treewide: devm_kzalloc() -> devm_kcalloc() 2018-06-12 16:19:22 -07:00
gpu Merge branch 'fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs 2018-07-22 12:04:51 -07:00
hid Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jikos/hid 2018-07-09 17:16:11 -07:00
hsi
hv treewide: kzalloc() -> kcalloc() 2018-06-12 16:19:22 -07:00
hwmon hwmon: (nct6775) Fix loop limit 2018-06-16 16:40:36 -07:00
hwspinlock hwspinlock updates for v4.18 2018-06-11 12:09:19 -07:00
hwtracing treewide: devm_kzalloc() -> devm_kcalloc() 2018-06-12 16:19:22 -07:00
i2c Merge branch 'i2c/for-current' of git://git.kernel.org/pub/scm/linux/kernel/git/wsa/linux 2018-07-13 15:34:29 -07:00
ide treewide: kzalloc() -> kcalloc() 2018-06-12 16:19:22 -07:00
idle
iio iio: imu: inv_mpu6050: Fix probe() failure on older ACPI based machines 2018-06-24 14:50:52 +01:00
infiniband Regression, user visible bugs, and crashing fixes: 2018-07-13 12:42:14 -07:00
input Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input 2018-06-27 09:16:53 -07:00
iommu Revert "iommu/vt-d: Clean up pasid quirk for pre-production devices" 2018-07-20 13:55:56 +02:00
ipack treewide: kzalloc() -> kcalloc() 2018-06-12 16:19:22 -07:00
irqchip irqchip/gic-v3-its: Fix reprogramming of redistributors on CPU hotplug 2018-06-22 14:22:02 +02:00
isdn Revert changes to convert to ->poll_mask() and aio IOCB_CMD_POLL 2018-06-28 10:40:47 -07:00
leds treewide: devm_kzalloc() -> devm_kcalloc() 2018-06-12 16:19:22 -07:00
lightnvm for-linus-20180623 2018-06-24 06:33:54 +08:00
macintosh powerpc updates for 4.18 2018-06-07 10:23:33 -07:00
mailbox treewide: devm_kzalloc() -> devm_kcalloc() 2018-06-12 16:19:22 -07:00
mcb
md - Fix DM writecache target to allow an optional offset to the start of 2018-07-20 14:24:17 -07:00
media bpf: fix attach type BPF_LIRC_MODE2 dependency wrt CONFIG_CGROUP_BPF 2018-06-26 11:28:38 +02:00
memory - Error path bug fix for overflow tests (Dan) 2018-06-12 18:28:00 -07:00
memstick treewide: kmalloc() -> kmalloc_array() 2018-06-12 16:19:22 -07:00
message treewide: kmalloc() -> kmalloc_array() 2018-06-12 16:19:22 -07:00
mfd Merge branch 'i2c/for-4.18' of git://git.kernel.org/pub/scm/linux/kernel/git/wsa/linux 2018-06-14 16:21:46 +09:00
misc Merge branch 'fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs 2018-07-22 12:04:51 -07:00
mmc mmc: sdhci-esdhc-imx: allow 1.8V modes without 100/200MHz pinctrl states 2018-07-09 11:17:47 +02:00
mtd mtd: spi-nor: cadence-quadspi: Fix direct mode write timeouts 2018-07-03 10:01:44 +02:00
mux
net net: axienet: Fix double deregister of mdio 2018-07-24 16:38:01 -07:00
nfc NFC: pn533: Fix wrong GFP flag usage 2018-06-25 21:36:45 +08:00
ntb - Error path bug fix for overflow tests (Dan) 2018-06-12 18:28:00 -07:00
nubus Char/Misc driver patches for 4.18-rc1 2018-06-05 16:20:22 -07:00
nvdimm * fix one ensures that a variable passed in by reference to 2018-07-13 10:54:01 -07:00
nvme nvme: fix handling of metadata_len for NVME_IOCTL_IO_CMD 2018-07-20 07:43:59 -07:00
nvmem nvmem: Don't let a NULL cell_id for nvmem_cell_get() crash us 2018-07-07 17:30:25 +02:00
of of: overlay: update phandle cache on overlay apply and remove 2018-07-16 08:41:32 -06:00
opp PM / OPP: Update voltage in case freq == old_freq 2018-06-19 15:53:32 +05:30
oprofile treewide: Use array_size() in vmalloc() 2018-06-12 16:19:22 -07:00
parisc
parport docs: Fix some broken references 2018-06-15 18:10:01 -03:00
pci pci-v4.18-fixes-3 2018-07-19 11:54:04 -07:00
pcmcia treewide: kzalloc() -> kcalloc() 2018-06-12 16:19:22 -07:00
perf drivers/perf: xgene_pmu: Fix IOB SLOW PMU parser error 2018-06-18 17:48:42 +01:00
phy phy: mapphone-mdm6600: Fix wrong enum used for status lines 2018-06-29 12:00:22 +05:30
pinctrl pinctrl: nsp: Fix potential NULL dereference 2018-07-14 12:47:04 +02:00
platform platform/x86: dell-laptop: Fix backlight detection 2018-07-20 15:29:59 +03:00
pnp media updates for v4.18-rc1 2018-06-07 12:34:37 -07:00
power treewide: devm_kzalloc() -> devm_kcalloc() 2018-06-12 16:19:22 -07:00
powercap treewide: kzalloc() -> kcalloc() 2018-06-12 16:19:22 -07:00
pps
ps3
ptp ptp: fix missing break in switch 2018-07-18 15:25:25 -07:00
pwm pwm: Changes for v4.18-rc1 2018-06-14 16:25:43 +09:00
rapidio treewide: Use array_size() in vmalloc() 2018-06-12 16:19:22 -07:00
ras
regulator treewide: devm_kzalloc() -> devm_kcalloc() 2018-06-12 16:19:22 -07:00
remoteproc treewide: use PHYS_ADDR_MAX to avoid type casting ULLONG_MAX 2018-06-15 07:55:25 +09:00
reset - Error path bug fix for overflow tests (Dan) 2018-06-12 18:28:00 -07:00
rpmsg
rtc rtc: fix alarm read and set offset 2018-07-13 10:37:54 +02:00
s390 Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/s390/linux 2018-07-06 09:14:34 -07:00
sbus fix a series of Documentation/ broken file name references 2018-06-15 18:10:01 -03:00
scsi Merge branch 'fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs 2018-07-22 12:04:51 -07:00
sfi
sh treewide: kzalloc() -> kcalloc() 2018-06-12 16:19:22 -07:00
siox
slimbus treewide: kzalloc() -> kcalloc() 2018-06-12 16:19:22 -07:00
sn
soc i.MX fixes for 4.18, round 3: 2018-07-19 15:09:59 -07:00
soundwire docs: Fix more broken references 2018-06-15 18:11:26 -03:00
spi treewide: devm_kzalloc() -> devm_kcalloc() 2018-06-12 16:19:22 -07:00
spmi
ssb
staging staging driver fixes for 4.18-rc7 2018-07-26 09:26:41 -07:00
target scsi: target: Fix truncated PR-in ReadKeys response 2018-06-19 21:36:37 -04:00
tc
tee
thermal - Error path bug fix for overflow tests (Dan) 2018-06-12 18:28:00 -07:00
thunderbolt thunderbolt: Notify userspace when boot_acl is changed 2018-07-07 17:29:17 +02:00
tty vt: prevent leaking uninitialized data to userspace via /dev/vcs* 2018-06-28 21:34:39 +09:00
uio uio: fix crash after the device is unregistered 2018-07-07 16:57:35 +02:00
usb usb: core: handle hub C_PORT_OVER_CURRENT condition 2018-07-21 08:38:29 +02:00
uwb treewide: kmalloc() -> kmalloc_array() 2018-06-12 16:19:22 -07:00
vfio powerpc fixes for 4.18 #4 2018-07-21 16:46:53 -07:00
vhost vhost_net: validate sock before trying to put its fd 2018-06-23 10:23:49 +09:00
video Solve a series of broken links for files under Documentation: 2018-06-17 05:25:18 +09:00
virt treewide: kzalloc() -> kcalloc() 2018-06-12 16:19:22 -07:00
virtio virtio, vhost: features, fixes 2018-06-16 06:35:02 +09:00
visorbus
vlynq
vme
w1 Char/Misc driver patches for 4.18-rc1 2018-06-05 16:20:22 -07:00
watchdog MIPS changes for 4.18 2018-06-12 12:56:02 -07:00
xen xen: fixes for 4.18-rc2 2018-06-23 20:44:11 +08:00
zorro - Introduce arithmetic overflow test helper functions (Rasmus) 2018-06-06 17:27:14 -07:00
Kconfig
Makefile