[PATCH 1/2] Check if start address is in vma region in NOMMU function get_user_pages().

[PATCH 1/2] Check if start address is in vma region in NOMMU function get_user_pages().

[David Howells]

From: Sonic Zhang <sonic.adi@gmail.com>

Hi,

In NOMMU arch, if run "cat /proc/self/mem", data from physical address
0 are read. This behavior is different from MMU arch.  In IA32,
message "cat: /proc/self/mem: Input/output error" is reported.

This issue is rootcaused by not validate the start address in NOMMU
function get_user_pages(). Following patch solves this issue.

Thanks

Sonic Zhang


Signed-off-by: Sonic Zhang <sonic.adi@gmail.com>
Signed-Off-By: David Howells <dhowells@redhat.com>
---

 mm/nommu.c |    8 ++++++--
 1 files changed, 6 insertions(+), 2 deletions(-)

diff --git a/mm/nommu.c b/mm/nommu.c
index 3215f46..2fe3fe4 100644
--- a/mm/nommu.c
+++ b/mm/nommu.c
@@ -129,16 +129,20 @@ int get_user_pages(struct task_struct *t
 	struct page **pages, struct vm_area_struct **vmas)
 {
 	int i;
-	static struct vm_area_struct dummy_vma;
+	struct vm_area_struct *vma;
 
 	for (i = 0; i < len; i++) {
+		vma = find_vma(mm, start);
+		if(!vma)
+			return i ? : -EFAULT;
+		
 		if (pages) {
 			pages[i] = virt_to_page(start);
 			if (pages[i])
 				page_cache_get(pages[i]);
 		}
 		if (vmas)
-			vmas[i] = &dummy_vma;
+			vmas[i] = vma;
 		start += PAGE_SIZE;
 	}
 	return(i);

[PATCH 2/2] NOMMU: Check VMA protections

[David Howells]

From: David Howells <dhowells@redhat.com>

Check the VMA protections in get_user_pages() against what's being asked.

This checks to see that we don't accidentally write on a non-writable VMA or
permit an I/O mapping VMA to be accessed (which may lack page structs).

This should be applied on top of Sonic Zhang's patch to the same function.

Signed-Off-By: David Howells <dhowells@redhat.com>
---

 mm/nommu.c |   32 ++++++++++++++++++++++++++------
 1 files changed, 26 insertions(+), 6 deletions(-)

diff --git a/mm/nommu.c b/mm/nommu.c
index 2fe3fe4..fa6850e 100644
--- a/mm/nommu.c
+++ b/mm/nommu.c
@@ -122,20 +122,36 @@ unsigned int kobjsize(const void *objp)
 }
 
 /*
- * The nommu dodgy version :-)
+ * get a list of pages in an address range belonging to the specified process
+ * and indicate the VMA that covers each page
+ * - this is potentially dodgy as we may end incrementing the page count of a
+ *   slab page or a secondary page from a compound page
+ * - don't permit access to VMAs that don't support it, such as I/O mappings
  */
 int get_user_pages(struct task_struct *tsk, struct mm_struct *mm,
 	unsigned long start, int len, int write, int force,
 	struct page **pages, struct vm_area_struct **vmas)
 {
-	int i;
 	struct vm_area_struct *vma;
+	unsigned long vm_flags;
+	int i;
+
+	/* calculate required read or write permissions.
+	 * - if 'force' is set, we only require the "MAY" flags.
+	 */
+	vm_flags  = write ? (VM_WRITE | VM_MAYWRITE) : (VM_READ | VM_MAYREAD);
+	vm_flags &= force ? (VM_MAYREAD | VM_MAYWRITE) : (VM_READ | VM_WRITE);
 
 	for (i = 0; i < len; i++) {
 		vma = find_vma(mm, start);
-		if(!vma)
-			return i ? : -EFAULT;
-		
+		if (!vma)
+			goto finish_or_fault;
+
+		/* protect what we can, including chardevs */
+		if (vma->vm_flags & (VM_IO | VM_PFNMAP) ||
+		    !(vm_flags & vma->vm_flags))
+			goto finish_or_fault;
+
 		if (pages) {
 			pages[i] = virt_to_page(start);
 			if (pages[i])
@@ -145,7 +161,11 @@ int get_user_pages(struct task_struct *t
 			vmas[i] = vma;
 		start += PAGE_SIZE;
 	}
-	return(i);
+
+	return i;
+
+finish_or_fault:
+	return i ? : -EFAULT;
 }
 
 EXPORT_SYMBOL(get_user_pages);