mirror of
https://github.com/BobTheBlinker/android_kernel_motorola_sm6375.git
synced 2026-10-06 03:45:24 -04:00
| Filename | Latest commit message | Latest commit date |
|---|---|---|
f4f235309b
commit bdebd6a2831b6fab69eb85cee74a8ba77f1a1cc2 upstream.
remap_vmalloc_range() has had various issues with the bounds checks it
promises to perform ("This function checks that addr is a valid
vmalloc'ed area, and that it is big enough to cover the vma") over time,
e.g.:
- not detecting pgoff<<PAGE_SHIFT overflow
- not detecting (pgoff<<PAGE_SHIFT)+usize overflow
- not checking whether addr and addr+(pgoff<<PAGE_SHIFT) are the same
vmalloc allocation
- comparing a potentially wildly out-of-bounds pointer with the end of
the vmalloc region
In particular, since commit fc9702273e2e ("bpf: Add mmap() support for
BPF_MAP_TYPE_ARRAY"), unprivileged users can cause kernel null pointer
dereferences by calling mmap() on a BPF map with a size that is bigger
than the distance from the start of the BPF map to the end of the
address space.
This could theoretically be used as a kernel ASLR bypass, by using
whether mmap() with a given offset oopses or returns an error code to
perform a binary search over the possible address range.
To allow remap_vmalloc_range_partial() to verify that addr and
addr+(pgoff<<PAGE_SHIFT) are in the same vmalloc region, pass the offset
to remap_vmalloc_range_partial() instead of adding it to the pointer in
remap_vmalloc_range().
In remap_vmalloc_range_partial(), fix the check against
get_vm_area_size() by using size comparisons instead of pointer
comparisons, and add checks for pgoff.
Fixes:
|
||
| .. | ||
| auxdisplay | ||
| binderfs | ||
| bpf | ||
| configfs | ||
| connector | ||
| hidraw | ||
| hw_breakpoint | ||
| kdb | ||
| kfifo | ||
| kobject | ||
| kprobes | ||
| livepatch | ||
| mei | ||
| mic/mpssd | ||
| pidfd | ||
| pktgen | ||
| qmi | ||
| rpmsg | ||
| seccomp | ||
| timers | ||
| trace_events | ||
| trace_printk | ||
| uhid | ||
| v4l | ||
| vfio-mdev | ||
| vfs | ||
| watchdog | ||
| Kconfig | ||
| Makefile | ||