Commit c6e8e36c authored by Fabio M. De Francesco's avatar Fabio M. De Francesco Committed by Kees Cook
Browse files

exec: Call kmap_local_page() in copy_string_kernel() 



The use of kmap_atomic() is being deprecated in favor of kmap_local_page().

With kmap_local_page(), the mappings are per thread, CPU local and not
globally visible. Furthermore, the mappings can be acquired from any
context (including interrupts).

Therefore, replace kmap_atomic() with kmap_local_page() in
copy_string_kernel(). Instead of open-coding local mapping + memcpy(),
use memcpy_to_page(). Delete a redundant call to flush_dcache_page().

Tested with xfstests on a QEMU/ KVM x86_32 VM, 6GB RAM, booting a kernel
with HIGHMEM64GB enabled.

Suggested-by: default avatarIra Weiny <ira.weiny@intel.com>
Signed-off-by: default avatarFabio M. De Francesco <fmdefrancesco@gmail.com>
Signed-off-by: default avatarKees Cook <keescook@chromium.org>
Link: https://lore.kernel.org/r/20220724212523.13317-1-fmdefrancesco@gmail.com
parent 5036793d

fs/exec.c

+1 −5
Original line number Diff line number Diff line
@@ -631,7 +631,6 @@ int copy_string_kernel(const char *arg, struct linux_binprm *bprm) 
		unsigned int bytes_to_copy = min_t(unsigned int, len,

				min_not_zero(offset_in_page(pos), PAGE_SIZE));

		struct page *page;

		char *kaddr;



		pos -= bytes_to_copy;

		arg -= bytes_to_copy;
@@ -640,11 +639,8 @@ int copy_string_kernel(const char *arg, struct linux_binprm *bprm) 
		page = get_arg_page(bprm, pos, 1);

		if (!page)

			return -E2BIG;

		kaddr = kmap_atomic(page);

		flush_arg_page(bprm, pos & PAGE_MASK, page);

		memcpy(kaddr + offset_in_page(pos), arg, bytes_to_copy);

		flush_dcache_page(page);

		kunmap_atomic(kaddr);

		memcpy_to_page(page, offset_in_page(pos), arg, bytes_to_copy);

		put_arg_page(page);

	}