summaryrefslogtreecommitdiffstats
path: root/mm/usercopy.c
diff options
context:
space:
mode:
authorMatthew Wilcox (Oracle) <willy@infradead.org>2022-06-12 22:32:25 +0100
committerKees Cook <keescook@chromium.org>2022-06-13 09:54:52 -0700
commit993d0b287e2ef7bee2e8b13b0ce4d2b5066f278e (patch)
tree853081efc2b49076ac29148901f66752393130ae /mm/usercopy.c
parent57cd6d157eb479f0a8e820fd36b7240845c8a937 (diff)
downloadlinux-993d0b287e2ef7bee2e8b13b0ce4d2b5066f278e.tar.gz
linux-993d0b287e2ef7bee2e8b13b0ce4d2b5066f278e.tar.bz2
linux-993d0b287e2ef7bee2e8b13b0ce4d2b5066f278e.zip
usercopy: Handle vm_map_ram() areas
vmalloc does not allocate a vm_struct for vm_map_ram() areas. That causes us to deny usercopies from those areas. This affects XFS which uses vm_map_ram() for its directories. Fix this by calling find_vmap_area() instead of find_vm_area(). Fixes: 0aef499f3172 ("mm/usercopy: Detect vmalloc overruns") Signed-off-by: Matthew Wilcox (Oracle) <willy@infradead.org> Reviewed-by: Uladzislau Rezki (Sony) <urezki@gmail.com> Tested-by: Zorro Lang <zlang@redhat.com> Signed-off-by: Kees Cook <keescook@chromium.org> Link: https://lore.kernel.org/r/20220612213227.3881769-2-willy@infradead.org
Diffstat (limited to 'mm/usercopy.c')
-rw-r--r--mm/usercopy.c10
1 files changed, 4 insertions, 6 deletions
diff --git a/mm/usercopy.c b/mm/usercopy.c
index baeacc735b83..cd4b41d9bf76 100644
--- a/mm/usercopy.c
+++ b/mm/usercopy.c
@@ -173,16 +173,14 @@ static inline void check_heap_object(const void *ptr, unsigned long n,
}
if (is_vmalloc_addr(ptr)) {
- struct vm_struct *area = find_vm_area(ptr);
+ struct vmap_area *area = find_vmap_area((unsigned long)ptr);
unsigned long offset;
- if (!area) {
+ if (!area)
usercopy_abort("vmalloc", "no area", to_user, 0, n);
- return;
- }
- offset = ptr - area->addr;
- if (offset + n > get_vm_area_size(area))
+ offset = (unsigned long)ptr - area->va_start;
+ if ((unsigned long)ptr + n > area->va_end)
usercopy_abort("vmalloc", NULL, to_user, offset, n);
return;
}