• K
    powerpc: Fix virt_addr_valid() check · 44634062
    Kefeng Wang 提交于
    hulk inclusion
    category: bugfix
    bugzilla: 186017 https://gitee.com/openeuler/kernel/issues/I4DDEL
    
    --------------------------------
    
    When run ethtool eth0, the BUG occurred,
    
      usercopy: Kernel memory exposure attempt detected from SLUB object not in SLUB page?! (offset 0, size 1048)!
      kernel BUG at mm/usercopy.c:99
      ...
      usercopy_abort+0x64/0xa0 (unreliable)
      __check_heap_object+0x168/0x190
      __check_object_size+0x1a0/0x200
      dev_ethtool+0x2494/0x2b20
      dev_ioctl+0x5d0/0x770
      sock_do_ioctl+0xf0/0x1d0
      sock_ioctl+0x3ec/0x5a0
      __se_sys_ioctl+0xf0/0x160
      system_call_exception+0xfc/0x1f0
      system_call_common+0xf8/0x200
    
    The code shows below,
    
      data = vzalloc(array_size(gstrings.len, ETH_GSTRING_LEN));
      copy_to_user(useraddr, data, gstrings.len * ETH_GSTRING_LEN))
    
    The data is alloced by vmalloc(), virt_addr_valid(ptr) will return true
    on PowerPC64, which leads to the panic.
    
    As commit 4dd7554a ("powerpc/64: Add VIRTUAL_BUG_ON checks for __va
    and __pa addresses") does, make sure the virt addr above PAGE_OFFSET in
    the virt_addr_valid().
    Signed-off-by: NKefeng Wang <wangkefeng.wang@huawei.com>
    Signed-off-by: NYuanzheng Song <songyuanzheng@huawei.com>
    Signed-off-by: NZheng Zengkai <zhengzengkai@huawei.com>
    44634062
page.h 10.0 KB