Unverified Commit ec0e9a4b authored by openeuler-ci-bot's avatar openeuler-ci-bot Committed by Gitee
Browse files

!10764 CVE-2024-41027 

Merge Pull Request from: @ci-robot 
 
PR sync from: Yongqiang Liu <liuyongqiang13@huawei.com>
https://mailweb.openeuler.org/hyperkitty/list/kernel@openeuler.org/message/R3OGV7BZHR4NAWRTOM2T5T5OZXYYRK2Y/ 
Audra Mitchell (1):
  Fix userfaultfd_api to return EINVAL as expected

Peter Xu (1):
  mm/userfaultfd: fail uffd-wp registration if not supported


-- 
2.34.1
 
https://gitee.com/src-openeuler/kernel/issues/IAGEN5 
 
Link:https://gitee.com/openeuler/kernel/pulls/10764

 

Reviewed-by: default avatarZhang Peng <zhangpeng362@huawei.com>
Reviewed-by: default avatarzhangyi (F) <yi.zhang@huawei.com>
Signed-off-by: default avatarYang Yingliang <yangyingliang@huawei.com>
parents 7df011ab de1b2a20

fs/userfaultfd.c

+14 −2
Original line number Diff line number Diff line
@@ -1306,8 +1306,12 @@ static int userfaultfd_register(struct userfaultfd_ctx *ctx, 
		goto out;

	if (uffdio_register.mode & UFFDIO_REGISTER_MODE_MISSING)

		vm_flags |= VM_UFFD_MISSING;

	if (uffdio_register.mode & UFFDIO_REGISTER_MODE_WP)

	if (uffdio_register.mode & UFFDIO_REGISTER_MODE_WP) {

#ifndef CONFIG_HAVE_ARCH_USERFAULTFD_WP

		goto out;

#endif

		vm_flags |= VM_UFFD_WP;

	}



	ret = validate_range(mm, uffdio_register.range.start,

			     uffdio_register.range.len);
@@ -1880,13 +1884,21 @@ static int userfaultfd_api(struct userfaultfd_ctx *ctx, 
		goto out;

	features = uffdio_api.features;

	ret = -EINVAL;

	if (uffdio_api.api != UFFD_API || (features & ~UFFD_API_FEATURES))

	if (uffdio_api.api != UFFD_API)

		goto err_out;

	ret = -EPERM;

	if ((features & UFFD_FEATURE_EVENT_FORK) && !capable(CAP_SYS_PTRACE))

		goto err_out;

	/* report all available features and ioctls to userland */

	uffdio_api.features = UFFD_API_FEATURES;

#ifndef CONFIG_HAVE_ARCH_USERFAULTFD_WP

	uffdio_api.features &= ~UFFD_FEATURE_PAGEFAULT_FLAG_WP;

#endif



	ret = -EINVAL;

	if (features & ~uffdio_api.features)

		goto err_out;



	uffdio_api.ioctls = UFFD_API_IOCTLS;

	ret = -EFAULT;

	if (copy_to_user(buf, &uffdio_api, sizeof(uffdio_api)))