From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-9.1 required=3.0 tests=DKIM_SIGNED,DKIM_VALID, DKIM_VALID_AU,INCLUDES_PATCH,MAILING_LIST_MULTI,SIGNED_OFF_BY,SPF_HELO_NONE, SPF_PASS,T_DKIMWL_WL_HIGH,URIBL_BLOCKED,USER_AGENT_GIT autolearn=ham autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id BCC3FC28CC1 for ; Sat, 1 Jun 2019 13:31:50 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.kernel.org (Postfix) with ESMTP id 95FF8274A5 for ; Sat, 1 Jun 2019 13:31:50 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1559395910; bh=tUIOEzh4JDtcY2cfw5wUgcn5PkYjRYg71HEBtp+J1hg=; h=From:To:Cc:Subject:Date:In-Reply-To:References:List-ID:From; b=RyFwkqRfNgQadxf/XRdIXsh8IWsaDbcxArRCLr+iXI30/CmAn897QFrK34TujwnuK 7YCNu/FHlsPz0rsA0+DH38IZK8QA8Tr31DbkdIFPor89l2oxV0NL5oqmJ1N84UmJc9 2ki9M3yiGtegmmWsED6TEqtQRlrt9TwqoqMVk9x0= Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1730066AbfFANbt (ORCPT ); Sat, 1 Jun 2019 09:31:49 -0400 Received: from mail.kernel.org ([198.145.29.99]:55868 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1729481AbfFANZc (ORCPT ); Sat, 1 Jun 2019 09:25:32 -0400 Received: from sasha-vm.mshome.net (c-73-47-72-35.hsd1.nh.comcast.net [73.47.72.35]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPSA id 9C5FF273B7; Sat, 1 Jun 2019 13:25:30 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1559395531; bh=tUIOEzh4JDtcY2cfw5wUgcn5PkYjRYg71HEBtp+J1hg=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=vtlNHDOYp7kcO/UunMGY8sqhzs2PdMAD5Bp4DsqVGoX4ZuQ6lBreyIY3Tz/nbOtHR 4UGyLZaHbEuOcIQGfe3LwlSj3Dn7x3l5fhA8LJjR98RBuDizx4BrOXGeaAuvQa3QQE a0kniHlGPwO0aX8QHOcjlA4YjNo7kQydqpyIPY7E= From: Sasha Levin To: linux-kernel@vger.kernel.org, stable@vger.kernel.org Cc: Cyrill Gorcunov , Andrey Vagin , Dmitry Safonov <0x7f454c46@gmail.com>, Pavel Emelyanov , Andrew Morton , Linus Torvalds , Sasha Levin Subject: [PATCH AUTOSEL 4.9 11/74] kernel/sys.c: prctl: fix false positive in validate_prctl_map() Date: Sat, 1 Jun 2019 09:23:58 -0400 Message-Id: <20190601132501.27021-11-sashal@kernel.org> X-Mailer: git-send-email 2.20.1 In-Reply-To: <20190601132501.27021-1-sashal@kernel.org> References: <20190601132501.27021-1-sashal@kernel.org> MIME-Version: 1.0 X-stable: review X-Patchwork-Hint: Ignore Content-Transfer-Encoding: 8bit Sender: linux-kernel-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org From: Cyrill Gorcunov [ Upstream commit a9e73998f9d705c94a8dca9687633adc0f24a19a ] While validating new map we require the @start_data to be strictly less than @end_data, which is fine for regular applications (this is why this nit didn't trigger for that long). These members are set from executable loaders such as elf handers, still it is pretty valid to have a loadable data section with zero size in file, in such case the start_data is equal to end_data once kernel loader finishes. As a result when we're trying to restore such programs the procedure fails and the kernel returns -EINVAL. From the image dump of a program: | "mm_start_code": "0x400000", | "mm_end_code": "0x8f5fb4", | "mm_start_data": "0xf1bfb0", | "mm_end_data": "0xf1bfb0", Thus we need to change validate_prctl_map from strictly less to less or equal operator use. Link: http://lkml.kernel.org/r/20190408143554.GY1421@uranus.lan Fixes: f606b77f1a9e3 ("prctl: PR_SET_MM -- introduce PR_SET_MM_MAP operation") Signed-off-by: Cyrill Gorcunov Cc: Andrey Vagin Cc: Dmitry Safonov <0x7f454c46@gmail.com> Cc: Pavel Emelyanov Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds Signed-off-by: Sasha Levin --- kernel/sys.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/kernel/sys.c b/kernel/sys.c index 6c4e9b5332584..157277cbf83aa 100644 --- a/kernel/sys.c +++ b/kernel/sys.c @@ -1762,7 +1762,7 @@ static int validate_prctl_map(struct prctl_mm_map *prctl_map) ((unsigned long)prctl_map->__m1 __op \ (unsigned long)prctl_map->__m2) ? 0 : -EINVAL error = __prctl_check_order(start_code, <, end_code); - error |= __prctl_check_order(start_data, <, end_data); + error |= __prctl_check_order(start_data,<=, end_data); error |= __prctl_check_order(start_brk, <=, brk); error |= __prctl_check_order(arg_start, <=, arg_end); error |= __prctl_check_order(env_start, <=, env_end); -- 2.20.1