On Mon, Oct 04, 2021 at 11:42:20PM +0100, Matthew Wilcox (Oracle) wrote:

We must prohibit page boundary crossing for kmap() addresses.
vmap() addresses are limited by the length of the mapping, and
compound pages are limited by the size of the page.

These should probably all have test cases?

Matthew Wilcox (Oracle) (3):
  mm/usercopy: Check kmap addresses properly
  mm/usercopy: Detect vmalloc overruns
  mm/usercopy: Detect compound page overruns

Thanks! This is a nice additional bit of checking. I wonder if the CMA
and Reserved pieces should be extracted from the PAGESPAN check too?
Probably that CONFIG should be renamed as well now. :P

-Kees

 arch/x86/include/asm/highmem.h   |  1 +
 include/linux/highmem-internal.h | 10 ++++++++++
 mm/usercopy.c                    | 33 +++++++++++++++++++++-----------
 3 files changed, 33 insertions(+), 11 deletions(-)

-- 
2.32.0

-- 
Kees Cook