]> www.infradead.org Git - users/dwmw2/linux.git/commit
ARM: 8901/1: add a criteria for pfn_valid of arm
authorzhaoyang <huangzhaoyang@gmail.com>
Mon, 26 Aug 2019 03:07:37 +0000 (04:07 +0100)
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Sat, 21 Sep 2019 05:15:39 +0000 (07:15 +0200)
commitae0bec785df67a13a8740379b8b21768c6775caa
tree2cfe7430a6f97118c290e4a89c3a02b1b833afc3
parenta8bea0667a33d9fbf21826c7c19b759d8eae5d11
ARM: 8901/1: add a criteria for pfn_valid of arm

[ Upstream commit 5b3efa4f1479c91cb8361acef55f9c6662feba57 ]

pfn_valid can be wrong when parsing a invalid pfn whose phys address
exceeds BITS_PER_LONG as the MSB will be trimed when shifted.

The issue originally arise from bellowing call stack, which corresponding to
an access of the /proc/kpageflags from userspace with a invalid pfn parameter
and leads to kernel panic.

[46886.723249] c7 [<c031ff98>] (stable_page_flags) from [<c03203f8>]
[46886.723264] c7 [<c0320368>] (kpageflags_read) from [<c0312030>]
[46886.723280] c7 [<c0311fb0>] (proc_reg_read) from [<c02a6e6c>]
[46886.723290] c7 [<c02a6e24>] (__vfs_read) from [<c02a7018>]
[46886.723301] c7 [<c02a6f74>] (vfs_read) from [<c02a778c>]
[46886.723315] c7 [<c02a770c>] (SyS_pread64) from [<c0108620>]
(ret_fast_syscall+0x0/0x28)

Signed-off-by: Zhaoyang Huang <zhaoyang.huang@unisoc.com>
Signed-off-by: Russell King <rmk+kernel@armlinux.org.uk>
Signed-off-by: Sasha Levin <sashal@kernel.org>
arch/arm/mm/init.c