Commit b5d1c39f authored Jul 11, 2019 by Andy Lutomirski Committed by Linus Torvalds Jul 12, 2019

mm/gup.c: remove some BUG_ONs from get_gate_page()

If we end up without a PGD or PUD entry backing the gate area, don't BUG
-- just fail gracefully.

It's not entirely implausible that this could happen some day on x86.  It
doesn't right now even with an execute-only emulated vsyscall page because
the fixmap shares the PUD, but the core mm code shouldn't rely on that
particular detail to avoid OOPSing.

Link: http://lkml.kernel.org/r/a1d9f4efb75b9d464e59fd6af00104b21c58f6f7.1561610798.git.luto@kernel.org


Signed-off-by: Andy Lutomirski <luto@kernel.org>
Reviewed-by: Kees Cook <keescook@chromium.org>
Reviewed-by: Andrew Morton <akpm@linux-foundation.org>
Cc: Florian Weimer <fweimer@redhat.com>
Cc: Jann Horn <jannh@google.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

parent aa712399

mm/gup.c

+6 −3

Original line number	Diff line number	Diff line
		@@ -586,11 +586,14 @@ static int get_gate_page(struct mm_struct *mm, unsigned long address,
		pgd = pgd_offset_k(address);
		else
		pgd = pgd_offset_gate(mm, address);
		BUG_ON(pgd_none(*pgd));
		if (pgd_none(*pgd))
		return -EFAULT;
		p4d = p4d_offset(pgd, address);
		BUG_ON(p4d_none(*p4d));
		if (p4d_none(*p4d))
		return -EFAULT;
		pud = pud_offset(p4d, address);
		BUG_ON(pud_none(*pud));
		if (pud_none(*pud))
		return -EFAULT;
		pmd = pmd_offset(pud, address);
		if (!pmd_present(*pmd))
		return -EFAULT;

Admin message