On Tue, Oct 05, 2021 at 10:43:13PM +0100, Matthew Wilcox wrote:

On Tue, Oct 05, 2021 at 02:23:09PM -0700, Kees Cook wrote:

quoted

quoted

+	if (is_kmap_addr(ptr)) {
+		unsigned long page_end = (unsigned long)ptr | (PAGE_SIZE - 1);
+
+		if ((unsigned long)ptr + n - 1 > page_end)
+			usercopy_abort("kmap", NULL, to_user, 0, n);

It's likely not worth getting an offset here, but "0" above could be
something like "ptr - PKMAP_ADDR(0)".

Mmm.  page_offset(ptr) should do the trick, no?

Ah yeah, that'd be good!

-Kees

quoted

Either way:

Acked-by: Kees Cook <redacted>

Thanks!

-Kees

quoted

+		return;
+	}
+
+	page = virt_to_head_page(ptr);
 
 	if (PageSlab(page)) {
 		/* Check slab allocator for flags and size. */
-- 
2.32.0

-- 
Kees Cook

-- 
Kees Cook