提交 a6541c35 编写于 作者: E Eric W. Biederman 提交者: Jialin Zhang

coredump: Remove the WARN_ON in dump_vma_snapshot

stable inclusion
from stable-v5.10.110
commit b043ae637a83585b2a497c2eb7ee49446fc68e98
category: bugfix
bugzilla: https://gitee.com/src-openeuler/kernel/issues/I6KT9C
CVE: CVE-2023-1249

Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=b043ae637a83585b2a497c2eb7ee49446fc68e98

--------------------------------

commit 49c18663 upstream.

The condition is impossible and to the best of my knowledge has never
triggered.

We are in deep trouble if that conditions happens and we walk past
the end of our allocated array.

So delete the WARN_ON and the code that makes it look like the kernel
can handle the case of walking past the end of it's vma_meta array.
Reviewed-by: NJann Horn <jannh@google.com>
Reviewed-by: NKees Cook <keescook@chromium.org>
Signed-off-by: N"Eric W. Biederman" <ebiederm@xmission.com>
Signed-off-by: NGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: NLi Huafei <lihuafei1@huawei.com>
Reviewed-by: NXu Kuohai <xukuohai@huawei.com>
Reviewed-by: NXiu Jianfeng <xiujianfeng@huawei.com>
Signed-off-by: NJialin Zhang <zhangjialin11@huawei.com>
上级 0e07125c
...@@ -1128,12 +1128,6 @@ static bool dump_vma_snapshot(struct coredump_params *cprm) ...@@ -1128,12 +1128,6 @@ static bool dump_vma_snapshot(struct coredump_params *cprm)
mmap_write_unlock(mm); mmap_write_unlock(mm);
if (WARN_ON(i != cprm->vma_count)) {
kvfree(cprm->vma_meta);
return false;
}
for (i = 0; i < cprm->vma_count; i++) { for (i = 0; i < cprm->vma_count; i++) {
struct core_vma_metadata *m = cprm->vma_meta + i; struct core_vma_metadata *m = cprm->vma_meta + i;
......
Markdown is supported
0% .
You are about to add 0 people to the discussion. Proceed with caution.
先完成此消息的编辑!
想要评论请 注册