linux_dsm_epyc7002/arch
Paul Burton 074a1e1167
MIPS: Bounds check virt_addr_valid
The virt_addr_valid() function is meant to return true iff
virt_to_page() will return a valid struct page reference. This is true
iff the address provided is found within the unmapped address range
between PAGE_OFFSET & MAP_BASE, but we don't currently check for that
condition. Instead we simply mask the address to obtain what will be a
physical address if the virtual address is indeed in the desired range,
shift it to form a PFN & then call pfn_valid(). This can incorrectly
return true if called with a virtual address which, after masking,
happens to form a physical address corresponding to a valid PFN.

For example we may vmalloc an address in the kernel mapped region
starting a MAP_BASE & obtain the virtual address:

  addr = 0xc000000000002000

When masked by virt_to_phys(), which uses __pa() & in turn CPHYSADDR(),
we obtain the following (bogus) physical address:

  addr = 0x2000

In a common system with PHYS_OFFSET=0 this will correspond to a valid
struct page which should really be accessed by virtual address
PAGE_OFFSET+0x2000, causing virt_addr_valid() to incorrectly return 1
indicating that the original address corresponds to a struct page.

This is equivalent to the ARM64 change made in commit ca219452c6
("arm64: Correctly bounds check virt_addr_valid").

This fixes fallout when hardened usercopy is enabled caused by the
related commit 517e1fbeb6 ("mm/usercopy: Drop extra
is_vmalloc_or_module() check") which removed a check for the vmalloc
range that was present from the introduction of the hardened usercopy
feature.

Signed-off-by: Paul Burton <paul.burton@mips.com>
References: ca219452c6 ("arm64: Correctly bounds check virt_addr_valid")
References: 517e1fbeb6 ("mm/usercopy: Drop extra is_vmalloc_or_module() check")
Reported-by: Julien Cristau <jcristau@debian.org>
Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Tested-by: YunQiang Su <ysu@wavecomp.com>
URL: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=929366
Cc: stable@vger.kernel.org # v4.12+
Cc: linux-mips@vger.kernel.org
Cc: Yunqiang Su <ysu@wavecomp.com>
2019-05-29 12:04:18 -07:00
..
alpha alpha: move arch/alpha/defconfig to arch/alpha/configs/defconfig 2019-05-18 11:49:55 +09:00
arc asm-generic: kill <asm/segment.h> and improve nommu generic uaccess helpers 2019-05-16 11:26:37 -07:00
arm Merge branch 'timers-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip 2019-05-19 11:11:20 -07:00
arm64 Merge branch 'irq-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip 2019-05-19 10:58:45 -07:00
c6x asm-generic: kill <asm/segment.h> and improve nommu generic uaccess helpers 2019-05-16 11:26:37 -07:00
csky arch: remove dangling asm-generic wrappers 2019-05-18 11:49:52 +09:00
h8300 arch: remove dangling asm-generic wrappers 2019-05-18 11:49:52 +09:00
hexagon asm-generic: kill <asm/segment.h> and improve nommu generic uaccess helpers 2019-05-16 11:26:37 -07:00
ia64 ia64: require -Wl,--hash-style=sysv 2019-05-18 11:29:01 +09:00
m68k Merge branch 'fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs 2019-05-17 09:46:31 -07:00
microblaze Merge branch 'fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs 2019-05-17 09:46:31 -07:00
mips MIPS: Bounds check virt_addr_valid 2019-05-29 12:04:18 -07:00
nds32 arch: remove dangling asm-generic wrappers 2019-05-18 11:49:52 +09:00
nios2 asm-generic: kill <asm/segment.h> and improve nommu generic uaccess helpers 2019-05-16 11:26:37 -07:00
openrisc asm-generic: kill <asm/segment.h> and improve nommu generic uaccess helpers 2019-05-16 11:26:37 -07:00
parisc Merge branch 'fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs 2019-05-17 09:46:31 -07:00
powerpc Merge branch 'akpm' (patches from Andrew) 2019-05-19 12:15:32 -07:00
riscv Kbuild updates for v5.2 (2nd) 2019-05-19 11:53:58 -07:00
s390 * ARM: support for SVE and Pointer Authentication in guests, PMU improvements 2019-05-17 10:33:30 -07:00
sh treewide: prefix header search paths with $(srctree)/ 2019-05-18 11:49:57 +09:00
sparc Merge branch 'fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs 2019-05-17 09:46:31 -07:00
um Merge branch 'core-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip 2019-05-19 10:23:24 -07:00
unicore32 Merge branch 'core-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip 2019-05-19 10:23:24 -07:00
x86 Kbuild updates for v5.2 (2nd) 2019-05-19 11:53:58 -07:00
xtensa treewide: prefix header search paths with $(srctree)/ 2019-05-18 11:49:57 +09:00
.gitignore
Kconfig Merge branch 'timers-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip 2019-05-16 11:00:20 -07:00