From: Zhaoyang Huang <huangzhaoyang@gmail.com>
To: Andrew Morton <akpm@linux-foundation.org>,
Zhaoyang Huang <zhaoyang.huang@unisoc.com>,
Russell King <linux@armlinux.org.uk>,
Mike Rapoport <rppt@linux.ibm.com>, Rob Herring <robh@kernel.org>,
Florian Fainelli <f.fainelli@gmail.com>,
Geert Uytterhoeven <geert@linux-m68k.org>,
Doug Berger <opendmb@gmail.com>,
linux-mm@kvack.org, linux-kernel@vger.kernel.org
Subject: [PATCH v3] arch : arm : add a criteria for pfn_valid
Date: Mon, 19 Aug 2019 13:50:08 +0800 [thread overview]
Message-ID: <1566193808-9153-1-git-send-email-huangzhaoyang@gmail.com> (raw)
In-Reply-To: <1566179120-5910-1-git-send-email-huangzhaoyang@gmail.com>
From: Zhaoyang Huang <zhaoyang.huang@unisoc.com>
pfn_valid can be wrong when parsing a invalid pfn whose phys address
exceeds BITS_PER_LONG as the MSB will be trimed when shifted.
The issue originally arise from bellowing call stack, which corresponding to
an access of the /proc/kpageflags from userspace with a invalid pfn parameter
and leads to kernel panic.
[46886.723249] c7 [<c031ff98>] (stable_page_flags) from [<c03203f8>]
[46886.723264] c7 [<c0320368>] (kpageflags_read) from [<c0312030>]
[46886.723280] c7 [<c0311fb0>] (proc_reg_read) from [<c02a6e6c>]
[46886.723290] c7 [<c02a6e24>] (__vfs_read) from [<c02a7018>]
[46886.723301] c7 [<c02a6f74>] (vfs_read) from [<c02a778c>]
[46886.723315] c7 [<c02a770c>] (SyS_pread64) from [<c0108620>]
(ret_fast_syscall+0x0/0x28)
Signed-off-by: Zhaoyang Huang <zhaoyang.huang@unisoc.com>
---
v2: use __pfn_to_phys/__phys_to_pfn instead of max_pfn as the criteria
v3: update commit message to describe the defection's context
---
arch/arm/mm/init.c | 5 +++++
1 file changed, 5 insertions(+)
diff --git a/arch/arm/mm/init.c b/arch/arm/mm/init.c
index c2daabb..cc769fa 100644
--- a/arch/arm/mm/init.c
+++ b/arch/arm/mm/init.c
@@ -177,6 +177,11 @@ static void __init zone_sizes_init(unsigned long min, unsigned long max_low,
#ifdef CONFIG_HAVE_ARCH_PFN_VALID
int pfn_valid(unsigned long pfn)
{
+ phys_addr_t addr = __pfn_to_phys(pfn);
+
+ if (__phys_to_pfn(addr) != pfn)
+ return 0;
+
return memblock_is_map_memory(__pfn_to_phys(pfn));
}
EXPORT_SYMBOL(pfn_valid);
--
1.9.1
next prev parent reply other threads:[~2019-08-19 5:50 UTC|newest]
Thread overview: 5+ messages / expand[flat|nested] mbox.gz Atom feed top
2019-08-19 1:36 [PATCH v2] arch : arm : add a criteria for pfn_valid Zhaoyang Huang
2019-08-19 1:45 ` Zhaoyang Huang
2019-08-19 5:50 ` Zhaoyang Huang [this message]
2019-08-20 12:45 ` [Resend PATCH v3] " Zhaoyang Huang
2019-08-19 4:55 ` [PATCH v2] " Mike Rapoport
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=1566193808-9153-1-git-send-email-huangzhaoyang@gmail.com \
--to=huangzhaoyang@gmail.com \
--cc=akpm@linux-foundation.org \
--cc=f.fainelli@gmail.com \
--cc=geert@linux-m68k.org \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-mm@kvack.org \
--cc=linux@armlinux.org.uk \
--cc=opendmb@gmail.com \
--cc=robh@kernel.org \
--cc=rppt@linux.ibm.com \
--cc=zhaoyang.huang@unisoc.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).