Re: [PATCH 0/3] Assorted improvements to usercopy

[Kees Cook <keescook@chromium.org>]

On Mon, Oct 04, 2021 at 11:42:20PM +0100, Matthew Wilcox (Oracle) wrote:
> We must prohibit page boundary crossing for kmap() addresses.
> vmap() addresses are limited by the length of the mapping, and
> compound pages are limited by the size of the page.
> 
> These should probably all have test cases?
> 
> Matthew Wilcox (Oracle) (3):
>   mm/usercopy: Check kmap addresses properly
>   mm/usercopy: Detect vmalloc overruns
>   mm/usercopy: Detect compound page overruns

Thanks! This is a nice additional bit of checking. I wonder if the CMA
and Reserved pieces should be extracted from the PAGESPAN check too?
Probably that CONFIG should be renamed as well now. :P

-Kees

> 
>  arch/x86/include/asm/highmem.h   |  1 +
>  include/linux/highmem-internal.h | 10 ++++++++++
>  mm/usercopy.c                    | 33 +++++++++++++++++++++-----------
>  3 files changed, 33 insertions(+), 11 deletions(-)
> 
> -- 
> 2.32.0
> 

-- 
Kees Cook