Linux kernel mirror (for testing) git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
kernel os linux

coredump: fix spam with zero VMA process

Nobody ever tried to self destruct by unmapping whole address space at
once:

munmap((void *)0, (1ULL << 47) - 4096);

Doing this produces 2 warnings for zero-length vmalloc allocations:

a.out[1353]: segfault at 7f80bcc4b757 ip 00007f80bcc4b757 sp 00007fff683939b8 error 14
a.out: vmalloc: allocation failure: 0 bytes, mode:0xcc0(GFP_KERNEL), nodemask=(null)
...
a.out: vmalloc: allocation failure: 0 bytes, mode:0xcc0(GFP_KERNEL), nodemask=(null)
...

Fix is to switch to kvmalloc().

Steps to reproduce:

// vsyscall=none
#include <sys/mman.h>
#include <sys/resource.h>
int main(void)
{
setrlimit(RLIMIT_CORE, &(struct rlimit){RLIM_INFINITY, RLIM_INFINITY});
munmap((void *)0, (1ULL << 47) - 4096);
return 0;
}

Link: http://lkml.kernel.org/r/20180410180353.GA2515@avx2
Signed-off-by: Alexey Dobriyan <adobriyan@gmail.com>
Reviewed-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

authored by

Alexey Dobriyan and committed by
Linus Torvalds
86a2bb5a c2574aaa

+9 -8
+9 -8
fs/binfmt_elf.c
··· 1621 1621 if (size >= MAX_FILE_NOTE_SIZE) /* paranoia check */ 1622 1622 return -EINVAL; 1623 1623 size = round_up(size, PAGE_SIZE); 1624 - data = vmalloc(size); 1625 - if (!data) 1624 + data = kvmalloc(size, GFP_KERNEL); 1625 + if (ZERO_OR_NULL_PTR(data)) 1626 1626 return -ENOMEM; 1627 1627 1628 1628 start_end_ofs = data + 2; ··· 1639 1639 filename = file_path(file, name_curpos, remaining); 1640 1640 if (IS_ERR(filename)) { 1641 1641 if (PTR_ERR(filename) == -ENAMETOOLONG) { 1642 - vfree(data); 1642 + kvfree(data); 1643 1643 size = size * 5 / 4; 1644 1644 goto alloc; 1645 1645 } ··· 1932 1932 kfree(t); 1933 1933 } 1934 1934 kfree(info->psinfo.data); 1935 - vfree(info->files.data); 1935 + kvfree(info->files.data); 1936 1936 } 1937 1937 1938 1938 #else ··· 2148 2148 2149 2149 /* Free data possibly allocated by fill_files_note(): */ 2150 2150 if (info->notes_files) 2151 - vfree(info->notes_files->data); 2151 + kvfree(info->notes_files->data); 2152 2152 2153 2153 kfree(info->prstatus); 2154 2154 kfree(info->psinfo); ··· 2294 2294 2295 2295 if (segs - 1 > ULONG_MAX / sizeof(*vma_filesz)) 2296 2296 goto end_coredump; 2297 - vma_filesz = vmalloc(array_size(sizeof(*vma_filesz), (segs - 1))); 2298 - if (!vma_filesz) 2297 + vma_filesz = kvmalloc(array_size(sizeof(*vma_filesz), (segs - 1)), 2298 + GFP_KERNEL); 2299 + if (ZERO_OR_NULL_PTR(vma_filesz)) 2299 2300 goto end_coredump; 2300 2301 2301 2302 for (i = 0, vma = first_vma(current, gate_vma); vma != NULL; ··· 2403 2402 cleanup: 2404 2403 free_note_info(&info); 2405 2404 kfree(shdr4extnum); 2406 - vfree(vma_filesz); 2405 + kvfree(vma_filesz); 2407 2406 kfree(phdr4note); 2408 2407 kfree(elf); 2409 2408 out: