Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1752601AbbHTI7S (ORCPT ); Thu, 20 Aug 2015 04:59:18 -0400 Received: from mail-pa0-f45.google.com ([209.85.220.45]:32974 "EHLO mail-pa0-f45.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1752331AbbHTI7R (ORCPT ); Thu, 20 Aug 2015 04:59:17 -0400 From: yalin wang To: bp@suse.de, mingo@kernel.org, dave@sr71.net, bhe@redhat.com, akpm@linux-foundation.org, yalin.wang2010@gmail.com, linux-kernel@vger.kernel.org Subject: [RFC] fs/kcore: change copy_to_user to copy_in_user Date: Thu, 20 Aug 2015 16:59:01 +0800 Message-Id: <1440061141-9778-1-git-send-email-yalin.wang2010@gmail.com> X-Mailer: git-send-email 1.9.1 Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Length: 1249 Lines: 37 the copy_to_user() here expect can fix the fault on both kernel and user address, this is not true on other platforms except x86, change to user copy_in_user() so that can detect the page fault, work as expected. Signed-off-by: yalin wang --- fs/proc/kcore.c | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) diff --git a/fs/proc/kcore.c b/fs/proc/kcore.c index 92e6726..4f28deb 100644 --- a/fs/proc/kcore.c +++ b/fs/proc/kcore.c @@ -515,8 +515,12 @@ read_kcore(struct file *file, char __user *buffer, size_t buflen, loff_t *fpos) } else { if (kern_addr_valid(start)) { unsigned long n; - - n = copy_to_user(buffer, (char *)start, tsz); + if ((start + tsz < tsz) || + (start + tsz) > TASK_SIZE) + return -EFAULT; + set_fs(KERNEL_DS); + n = copy_in_user(buffer, (char *)start, tsz); + set_fs(USER_DS); /* * We cannot distinguish between fault on source * and fault on destination. When this happens -- 1.9.1 -- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/