Skip to content

Commit 5a06fcb

Browse files
committed
lib/test_lockup: fix kernel pointer check for separate address spaces
test_kernel_ptr() uses access_ok() to figure out if a given address points to user space instead of kernel space. However on architectures that set CONFIG_ALTERNATE_USER_ADDRESS_SPACE, a pointer can be valid for both, and the check always fails because access_ok() returns true. Make the check for user space pointers conditional on the type of address space layout. Signed-off-by: Arnd Bergmann <[email protected]>
1 parent 12700c1 commit 5a06fcb

File tree

1 file changed

+8
-3
lines changed

1 file changed

+8
-3
lines changed

lib/test_lockup.c

Lines changed: 8 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -417,9 +417,14 @@ static bool test_kernel_ptr(unsigned long addr, int size)
417417
return false;
418418

419419
/* should be at least readable kernel address */
420-
if (access_ok((void __user *)ptr, 1) ||
421-
access_ok((void __user *)ptr + size - 1, 1) ||
422-
get_kernel_nofault(buf, ptr) ||
420+
if (!IS_ENABLED(CONFIG_ALTERNATE_USER_ADDRESS_SPACE) &&
421+
(access_ok((void __user *)ptr, 1) ||
422+
access_ok((void __user *)ptr + size - 1, 1))) {
423+
pr_err("user space ptr invalid in kernel: %#lx\n", addr);
424+
return true;
425+
}
426+
427+
if (get_kernel_nofault(buf, ptr) ||
423428
get_kernel_nofault(buf, ptr + size - 1)) {
424429
pr_err("invalid kernel ptr: %#lx\n", addr);
425430
return true;

0 commit comments

Comments
 (0)