duff/android_kernel_motorola_sm6225
1
0 Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

moto_mmap_fault: Fix KASAN report use-after-free

Browse Source 
ra_pages is defined "unsinged int", use "unsinged long" may cause mmap_miss
be overridden

KASAN report:
[ 1870.506567][T24426] ela_global-io: [name:report&]BUG: KASAN: use-after-free in filemap_fault_cache_page+0x60/0x14c [moto_mmap_fault]
[ 1870.506590][T24426] ela_global-io: [name:report&]Read of size 8 at addr ffffff80c936a2f0 by task ela_global-io/24426
[ 1870.506607][T24426] ela_global-io: [name:report&]
[ 1870.506634][T24426] ela_global-io: CPU: 0 PID: 24426 Comm: ela_global-io Tainted: P W O 5.10.168-android12-9-g8b5ca9694820-dirty #1
[ 1870.506651][T24426] ela_global-io: Hardware name: MT6879V_T/ZA (DT)
[ 1870.506670][T24426] ela_global-io: Call trace:
[ 1870.506701][T24426] ela_global-io: dump_backtrace+0x0/0x480
[ 1870.506722][T24426] ela_global-io: show_stack+0x1c/0x2c
[ 1870.506745][T24426] ela_global-io: dump_stack_lvl+0x13c/0x190
[ 1870.506769][T24426] ela_global-io: print_address_description+0x80/0x2ac
[ 1870.506791][T24426] ela_global-io: __kasan_report+0xf8/0x1a8
[ 1870.506811][T24426] ela_global-io: kasan_report+0x4c/0x88
[ 1870.506832][T24426] ela_global-io: __asan_report_load8_noabort+0x48/0x58
[ 1870.506856][T24426] ela_global-io: filemap_fault_cache_page+0x60/0x14c [moto_mmap_fault]
[ 1870.506882][T24426] ela_global-io: __traceiter_android_vh_filemap_fault_cache_page+0x84/0xc0
[ 1870.506906][T24426] ela_global-io: filemap_fault+0x14e0/0x163c
Change-Id: I915f54a5151a11284f828ae940c10b1e38b2460b
Reviewed-on: https://gerrit.mot.com/2683986
SME-Granted: SME Approvals Granted
SLTApproved: Slta Waiver
Tested-by: Jira Key
Reviewed-by: Zonghua Liu <a17671@motorola.com>
Reviewed-by: Zhangqing Huang <huangzq2@motorola.com>
Reviewed-by: Huosheng Liao <liaohs@motorola.com>
Submit-Approved: Jira Key
Reviewed-on: https://gerrit.mot.com/2700717
This commit is contained in:
Xiaojun Ji committed 2023-08-06 22:22:09 -05:00
1 parent 26c4796240
commit 453244628e
1 file changed
+1 -1
Download Patch File Download Diff File Expand all files Collapse all files
drivers/moto_mmap_fault/moto_mmap_fault.c
+1 -1
View File
@@ -77,7 +77,7 @@ static void __nocfi filemap_fault_cache_page(void *p, struct vm_fault *vmf, stru
if ((ra->ra_pages == max_ra_pages) && (vmf->android_oem_data1[0] != 0)
&& (vmf->android_oem_data1[1] == max_ra_pages)) {
ra->ra_pages = (unsigned long)vmf->android_oem_data1[0]; //restore the old ra_pages
ra->ra_pages = (unsigned int)vmf->android_oem_data1[0]; //restore the old ra_pages
vmf->android_oem_data1[0] = 0;
vmf->android_oem_data1[1] = 0;
}