On Wed, Dec 06, 2017 at 04:43:50PM -0800, Andrew Morton wrote: > On Sat, 2 Dec 2017 14:27:39 +0100 Heiko Carstens <[email protected]> > wrote: > > > git commit df04abfd181a ("fs/proc/kcore.c: Add bounce buffer for ktext > > data") added a bounce buffer to avoid hardened usercopy > > checks. Copying to the bounce buffer was implemented with a simple > > memcpy() assuming that it is always valid to read from kernel memory > > iff the kern_addr_valid() check passed. > > > > A simple, but pointless, test case like "dd if=/proc/kcore > > of=/dev/null" now can easily crash the kernel, since the former > > execption handling on invalid kernel addresses now doesn't work > > anymore. > > > > Also adding a kern_addr_valid() implementation wouldn't help > > here. Most architectures simply return 1 here, while a couple > > implemented a page table walk to figure out if something is mapped at > > the address in question. > > With DEBUG_PAGEALLOC active mappings are established and removed all > > the time, so that relying on the result of kern_addr_valid() before > > executing the memcpy() also doesn't work. > > > > Therefore simply use probe_kernel_read() to copy to the bounce > > buffer. This also allows to simplify read_kcore(). > > > > At least on s390 this fixes the observed crashes and doesn't introduce > > warnings that were removed with df04abfd181a ("fs/proc/kcore.c: Add > > bounce buffer for ktext data"), even though the generic > > probe_kernel_read() implementation uses uaccess functions. > > > > While looking into this I'm also wondering if kern_addr_valid() could > > be completely removed...(?) > > > > Fixes: df04abfd181a ("fs/proc/kcore.c: Add bounce buffer for ktext data") > > Fixes: f5509cc18daa ("mm: Hardened usercopy") > > It's a privileged operation, but oopsing root's kernel is still a bit > rude. So I'll add cc:stable. And let it bake until 4.16-rc1, since > the bug has been there for a year or more. Sound OK?
Yes, that sounds ok to me. Thank you!
