projects
/
linux-block.git
/ commitdiff
commit
grep
author
committer
pickaxe
?
search:
re
summary
|
shortlog
|
log
|
commit
| commitdiff |
tree
raw
|
patch
| inline |
side by side
(parent:
7e364e5
)
iommufd: Check for uptr overflow
author
Jason Gunthorpe
<jgg@nvidia.com>
Fri, 31 Mar 2023 15:32:24 +0000
(12:32 -0300)
committer
Jason Gunthorpe
<jgg@nvidia.com>
Tue, 4 Apr 2023 12:10:55 +0000
(09:10 -0300)
syzkaller found that setting up a map with a user VA that wraps past zero
can trigger WARN_ONs, particularly from pin_user_pages weirdly returning 0
due to invalid arguments.
Prevent creating a pages with a uptr and size that would math overflow.
WARNING: CPU: 0 PID: 518 at drivers/iommu/iommufd/pages.c:793 pfn_reader_user_pin+0x2e6/0x390
Modules linked in:
CPU: 0 PID: 518 Comm: repro Not tainted 6.3.0-rc2-
eeac8ede1755
+ #1
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS
rel-1.16.0-0-gd239552ce722
-prebuilt.qemu.org 04/01/2014
RIP: 0010:pfn_reader_user_pin+0x2e6/0x390
Code: b1 11 e9 25 fe ff ff e8 28 e4 0f ff 31 ff 48 89 de e8 2e e6 0f ff 48 85 db 74 0a e8 14 e4 0f ff e9 4d ff ff ff e8 0a e4 0f ff <0f> 0b bb f2 ff ff ff e9 3c ff ff ff e8 f9 e3 0f ff ba 01 00 00 00
RSP: 0018:
ffffc90000f9fa30
EFLAGS:
00010246
RAX:
0000000000000000
RBX:
0000000000000000
RCX:
ffffffff821e2b72
RDX:
0000000000000000
RSI:
ffff888014184680
RDI:
0000000000000002
RBP:
ffffc90000f9fa78
R08:
00000000000000ff
R09:
0000000079de6f4e
R10:
ffffc90000f9f790
R11:
ffff888014185418
R12:
ffffc90000f9fc60
R13:
0000000000000002
R14:
ffff888007879800
R15:
0000000000000000
FS:
00007f4227555740
(0000) GS:
ffff88807dc00000
(0000) knlGS:
0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0:
0000000080050033
CR2:
0000000020000043
CR3:
000000000e748005
CR4:
0000000000770ef0
PKRU:
55555554
Call Trace:
<TASK>
pfn_reader_next+0x14a/0x7b0
? interval_tree_double_span_iter_update+0x11a/0x140
pfn_reader_first+0x140/0x1b0
iopt_pages_rw_slow+0x71/0x280
? __this_cpu_preempt_check+0x20/0x30
iopt_pages_rw_access+0x2b2/0x5b0
iommufd_access_rw+0x19f/0x2f0
iommufd_test+0xd11/0x16f0
? write_comp_data+0x2f/0x90
iommufd_fops_ioctl+0x206/0x330
__x64_sys_ioctl+0x10e/0x160
? __pfx_iommufd_fops_ioctl+0x10/0x10
do_syscall_64+0x3b/0x90
entry_SYSCALL_64_after_hwframe+0x72/0xdc
Cc: <stable@vger.kernel.org>
Fixes:
8d160cd4d506
("iommufd: Algorithms for PFN storage")
Link:
https://lore.kernel.org/r/1-v1-ceab6a4d7d7a+94-iommufd_syz_jgg@nvidia.com
Reviewed-by: Kevin Tian <kevin.tian@intel.com>
Reported-by: Pengfei Xu <pengfei.xu@intel.com>
Tested-by: Pengfei Xu <pengfei.xu@intel.com>
Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
drivers/iommu/iommufd/pages.c
patch
|
blob
|
blame
|
history
diff --git
a/drivers/iommu/iommufd/pages.c
b/drivers/iommu/iommufd/pages.c
index f8d92c9bb65b603add9596e9040907c587843035..400ec7c91ed7e77b56755dc86d1a2f21a26b9ba7 100644
(file)
--- a/
drivers/iommu/iommufd/pages.c
+++ b/
drivers/iommu/iommufd/pages.c
@@
-1142,6
+1142,7
@@
struct iopt_pages *iopt_alloc_pages(void __user *uptr, unsigned long length,
bool writable)
{
struct iopt_pages *pages;
+ unsigned long end;
/*
* The iommu API uses size_t as the length, and protect the DIV_ROUND_UP
@@
-1150,6
+1151,9
@@
struct iopt_pages *iopt_alloc_pages(void __user *uptr, unsigned long length,
if (length > SIZE_MAX - PAGE_SIZE || length == 0)
return ERR_PTR(-EINVAL);
+ if (check_add_overflow((unsigned long)uptr, length, &end))
+ return ERR_PTR(-EOVERFLOW);
+
pages = kzalloc(sizeof(*pages), GFP_KERNEL_ACCOUNT);
if (!pages)
return ERR_PTR(-ENOMEM);