Subject: Re: [PATCH] mm: Fix overflow check in expand_upwards()
To: =?UTF-8?Q?J=c3=b6rn_Engel?= <joern@purestorage.com>,
        Hugh Dickins <hughd@google.com>, linux-kernel@vger.kernel.org
References: <20170629230256.GB494@cork>
From: Helge Deller <deller@gmx.de>
Message-ID: <747944b6-ffb8-14db-d574-efc03e11f2a5@gmx.de>
Date: Fri, 30 Jun 2017 08:57:27 +0200
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:45.0) Gecko/20100101
 Thunderbird/45.8.0
MIME-Version: 1.0
In-Reply-To: <20170629230256.GB494@cork>
Content-Type: text/plain; charset=windows-1252
Content-Transfer-Encoding: 8bit
Sender: linux-kernel-owner@vger.kernel.org
Content-Length: 1729
Lines: 55

On 30.06.2017 01:02, J?rn Engel wrote:
> I believe the overflow check was correct, then got subtly broken by
> 	commit bd726c90b6b8
> 	Author: Helge Deller <deller@gmx.de>
> 	Date:   Mon Jun 19 17:34:05 2017 +0200
> 
> 	    Allow stack to grow up to address space limit
> 
> The old overflow check may have been a bit subtle and I suppose Helge
> missed its importance.
> 
> 	if (!address)
> 		return -ENOMEM;
> 
> Functionally the my check is identical to the old one.  I just hope the
> alternative form (and comment!) make it harder to miss and break things
> in a future patch.
> 
> Signed-off-by: Joern Engel <joern@logfs.org>
> ---
>  mm/mmap.c | 3 ++-
>  1 file changed, 2 insertions(+), 1 deletion(-)
> 
> diff --git a/mm/mmap.c b/mm/mmap.c
> index a5e3dcd75e79..7366f62c31f4 100644
> --- a/mm/mmap.c
> +++ b/mm/mmap.c
> @@ -2232,7 +2232,8 @@ int expand_upwards(struct vm_area_struct *vma, unsigned long address)
>  
>  	/* Guard against exceeding limits of the address space. */
>  	address &= PAGE_MASK;
> -	if (address >= TASK_SIZE)
> +	/* second check is for integer overflow */
> +	if (address >= TASK_SIZE || address + PAGE_SIZE < address)
>  		return -ENOMEM;
>  	address += PAGE_SIZE;

That overflow check is still there.
Look at the next few lines in mmap.c:

       /* Enforce stack_guard_gap */
        gap_addr = address + stack_guard_gap;

        /* Guard against overflow */
        if (gap_addr < address || gap_addr > TASK_SIZE)
                gap_addr = TASK_SIZE;

If the requested page plus the gap (=gap_addr) wraps around, then the
code will limit it to TASK_SIZE.
So, the code should already take care of all possible areas >=TASK_SIZE,
including wrap-arounds.

Did you faced a real issue?

Helge