On Tue, Sep 17, 2019 at 11:00:25AM -0700, Kees Cook wrote:
> When running on a system with >512MB RAM with a 32-bit kernel built with:
>
> CONFIG_DEBUG_VIRTUAL=y
> CONFIG_HIGHMEM=y
> CONFIG_HARDENED_USERCOPY=y
>
> all execve()s will fail due to argv copying into kmap()ed pages, and on
> usercopy checking the calls ultimately of virt_to_page() will be looking
> for "bad" kmap (highmem) pointers due to CONFIG_DEBUG_VIRTUAL=y:
>
> Now we can fetch the correct page to avoid the pfn check. In both cases,
> hardened usercopy will need to walk the page-span checker (if enabled)
> to do sanity checking.
>
> Reported-by: Randy Dunlap <rdunlap@xxxxxxxxxxxxx>
> Tested-by: Randy Dunlap <rdunlap@xxxxxxxxxxxxx>
> Fixes: f5509cc18daa ("mm: Hardened usercopy")
> Cc: Matthew Wilcox <willy@xxxxxxxxxxxxx>
Reviewed-by: Matthew Wilcox (Oracle) <willy@xxxxxxxxxxxxx>
I want to make virt_to_page() do the right thing for kmapped pages,
but that is completely outside the scope of this patch.
