Messages in this thread Patch in this message | | | From | Zhaoyang Huang <> | Date | Tue, 20 Aug 2019 20:45:41 +0800 | Subject | [Resend PATCH v3] arch : arm : add a criteria for pfn_valid |
| |
From: Zhaoyang Huang <zhaoyang.huang@unisoc.com>
pfn_valid can be wrong when parsing a invalid pfn whose phys address exceeds BITS_PER_LONG as the MSB will be trimed when shifted.
The issue originally arise from bellowing call stack, which corresponding to an access of the /proc/kpageflags from userspace with a invalid pfn parameter and leads to kernel panic.
[46886.723249] c7 [<c031ff98>] (stable_page_flags) from [<c03203f8>] [46886.723264] c7 [<c0320368>] (kpageflags_read) from [<c0312030>] [46886.723280] c7 [<c0311fb0>] (proc_reg_read) from [<c02a6e6c>] [46886.723290] c7 [<c02a6e24>] (__vfs_read) from [<c02a7018>] [46886.723301] c7 [<c02a6f74>] (vfs_read) from [<c02a778c>] [46886.723315] c7 [<c02a770c>] (SyS_pread64) from [<c0108620>] (ret_fast_syscall+0x0/0x28)
Signed-off-by: Zhaoyang Huang <zhaoyang.huang@unisoc.com> Reviewed-by: Mike Rapoport <rppt@linux.ibm.com> --- v2: use __pfn_to_phys/__phys_to_pfn instead of max_pfn as the criteria v3: update commit message to describe the defection's context add Mike Rapoport as reviewer --- arch/arm/mm/init.c | 5 +++++ 1 file changed, 5 insertions(+)
diff --git a/arch/arm/mm/init.c b/arch/arm/mm/init.c index c2daabb..cc769fa 100644 --- a/arch/arm/mm/init.c +++ b/arch/arm/mm/init.c @@ -177,6 +177,11 @@ static void __init zone_sizes_init(unsigned long min, unsigned long max_low, #ifdef CONFIG_HAVE_ARCH_PFN_VALID int pfn_valid(unsigned long pfn) { + phys_addr_t addr = __pfn_to_phys(pfn); + + if (__phys_to_pfn(addr) != pfn) + return 0; + return memblock_is_map_memory(__pfn_to_phys(pfn)); } EXPORT_SYMBOL(pfn_valid); -- 1.9.1
| |