some large create_module(2) sizes can oops a kernel
PATCH 1/1 some large create_module(2) sizes can oops a kernel
Hi Rusty aka trivial patch monkey, everyone,
The 2.4 kernel will oops when create_module(2) is passed a size of -1, -2, or any size larger than num_physpages. The following patch is one of the many simple ways to fix this. Please consider it or some variant for inclusion in 2.4.
I mention this issue only because the kernel should not be panic-able based on user input to system services.
This patch leaves unfixed the sparc64, x86_64, and generic architectures. Only the i386 was tested.
Regards,
Joe
include/asm-alpha/module.h +1 -1
@@ -4,7 +4,7 @@* This file contains the alpha architecture specific module code. */ -#define module_map (x) vmalloc(x) +#define module_map (x) (((size >> PAGE_SHIFT) > num_physpages) ? NULL : vmalloc(x))#define module_unmap (x) vfree(x)#define module_arch_init (x) alpha_module_init(x)#define arch_init_modules (x) alpha_init_modules(x)
include/asm-arm/module.h +1 -1
@@ -4,7 +4,7 @@* This file contains the arm architecture specific module code. */ -#define module_map (x) vmalloc(x) +#define module_map (x) (((size >> PAGE_SHIFT) > num_physpages) ? NULL : vmalloc(x))#define module_unmap (x) vfree(x)#define module_arch_init (x) (0)#define arch_init_modules (x) do { } while (0)
include/asm-cris/module.h +1 -1
@@ -4,7 +4,7 @@* This file contains the CRIS architecture specific module code. */ -#define module_map (x) vmalloc(x) +#define module_map (x) (((size >> PAGE_SHIFT) > num_physpages) ? NULL : vmalloc(x))#define module_unmap (x) vfree(x)#define module_arch_init (x) (0)#define arch_init_modules (x) do { } while (0)
include/asm-i386/module.h +1 -1
@@ -4,7 +4,7 @@* This file contains the i386 architecture specific module code. */ -#define module_map (x) vmalloc(x) +#define module_map (x) (((size >> PAGE_SHIFT) > num_physpages) ? NULL : vmalloc(x))#define module_unmap (x) vfree(x)#define module_arch_init (x) (0)#define arch_init_modules (x) do { } while (0)
Only in 2.4.21-pre3-jak/include/asm-i386: module.h.orig
include/asm-ia64/module.h +1 -1
@@ -11,7 +11,7 @@#include <linux/vmalloc.h> #include <asm/unwind.h> -#define module_map (x) vmalloc(x) +#define module_map (x) (((size >> PAGE_SHIFT) > num_physpages) ? NULL : vmalloc(x))#define module_unmap (x) ia64_module_unmap(x)#define module_arch_init (x) ia64_module_init(x)
include/asm-m68k/module.h +1 -1
@@ -4,7 +4,7 @@* This file contains the m68k architecture specific module code. */ -#define module_map (x) vmalloc(x) +#define module_map (x) (((size >> PAGE_SHIFT) > num_physpages) ? NULL : vmalloc(x))#define module_unmap (x) vfree(x)#define module_arch_init (x) (0)#define arch_init_modules (x) do { } while (0)
include/asm-mips/module.h +1 -1
@@ -7,7 +7,7 @@#include <linux/module.h> #include <asm/uaccess.h> -#define module_map (x) vmalloc(x) +#define module_map (x) (((size >> PAGE_SHIFT) > num_physpages) ? NULL : vmalloc(x))#define module_unmap (x) vfree(x)#define module_arch_init (x) mips_module_init(x)#define arch_init_modules (x) mips_init_modules(x)
include/asm-mips64/module.h +1 -1
@@ -7,7 +7,7 @@#include <linux/module.h> #include <asm/uaccess.h> -#define module_map (x) vmalloc(x) +#define module_map (x) (((size >> PAGE_SHIFT) > num_physpages) ? NULL : vmalloc(x))#define module_unmap (x) vfree(x)#define module_arch_init (x) mips64_module_init(x)#define arch_init_modules (x) mips64_init_modules(x)
include/asm-parisc/module.h +1 -1
@@ -4,7 +4,7 @@* This file contains the parisc architecture specific module code. */ -#define module_map (x) vmalloc(x) +#define module_map (x) (((size >> PAGE_SHIFT) > num_physpages) ? NULL : vmalloc(x))#define module_unmap (x) vfree(x)#define module_arch_init (x) (0)#define arch_init_modules (x) do { } while (0)
include/asm-ppc/module.h +1 -1
@@ -7,7 +7,7 @@* This file contains the PPC architecture specific module code. */ -#define module_map (x) vmalloc(x) +#define module_map (x) (((size >> PAGE_SHIFT) > num_physpages) ? NULL : vmalloc(x))#define module_unmap (x) vfree(x)#define module_arch_init (x) (0)#define arch_init_modules (x) do { } while (0)
include/asm-ppc64/module.h +1 -1
@@ -11,7 +11,7 @@* 2 of the License, or (at your option) any later version. */ -#define module_map (x) vmalloc(x) +#define module_map (x) (((size >> PAGE_SHIFT) > num_physpages) ? NULL : vmalloc(x))#define module_unmap (x) vfree(x)#define arch_init_modules (x) do { } while (0)#define module_arch_init (x) (0)
include/asm-s390/module.h +1 -1
@@ -4,7 +4,7 @@* This file contains the s390 architecture specific module code. */ -#define module_map (x) vmalloc(x) +#define module_map (x) (((size >> PAGE_SHIFT) > num_physpages) ? NULL : vmalloc(x))#define module_unmap (x) vfree(x)#define module_arch_init (x) (0)#define arch_init_modules (x) do { } while (0)
include/asm-s390x/module.h +1 -1
@@ -4,7 +4,7 @@* This file contains the s390 architecture specific module code. */ -#define module_map (x) vmalloc(x) +#define module_map (x) (((size >> PAGE_SHIFT) > num_physpages) ? NULL : vmalloc(x))#define module_unmap (x) vfree(x)#define module_arch_init (x) (0)#define arch_init_modules (x) do { } while (0)
include/asm-sh/module.h +1 -1
@@ -4,7 +4,7 @@* This file contains the SH architecture specific module code. */ -#define module_map (x) vmalloc(x) +#define module_map (x) (((size >> PAGE_SHIFT) > num_physpages) ? NULL : vmalloc(x))#define module_unmap (x) vfree(x)#define module_arch_init (x) (0)#define arch_init_modules (x) do { } while (0)
include/asm-sparc/module.h +1 -1
@@ -4,7 +4,7 @@* This file contains the sparc architecture specific module code. */ -#define module_map (x) vmalloc(x) +#define module_map (x) (((size >> PAGE_SHIFT) > num_physpages) ? NULL : vmalloc(x))#define module_unmap (x) vfree(x)#define module_arch_init (x) (0)#define arch_init_modules (x) do { } while (0)
In message <[email protected]> you write:
Quoted 6 lines
Hi Rusty aka trivial patch monkey, everyone,
The 2.4 kernel will oops when
create_module(2)is passed a size of -1, -2, or any size larger thannum_physpages. The following patch is one of the many simple ways to fix this. Please consider it or some variant for inclusion in 2.4.
How about removing the BUG() from vmalloc.c, like 2.5 has done?
Rusty.
--
Anyone who quotes me in their sig is an idiot. -- Rusty Russell.
Quoted 1 line
How about removing the
BUG()fromvmalloc.c, like 2.5 has done?
I was erring on the safe side of assuming the BUG was useful for detecting internal (non-user) erronous uses of vmalloc. However if that is not an issue then removing the BUG is best.
Joe