From 453244628ee4ab7b849b4015d382e78c8e3bf584 Mon Sep 17 00:00:00 2001 From: Xiaojun Ji Date: Fri, 21 Jul 2023 10:11:55 +0800 Subject: [PATCH] moto_mmap_fault: Fix KASAN report use-after-free ra_pages is defined "unsinged int", use "unsinged long" may cause mmap_miss be overridden KASAN report: [ 1870.506567][T24426] ela_global-io: [name:report&]BUG: KASAN: use-after-free in filemap_fault_cache_page+0x60/0x14c [moto_mmap_fault] [ 1870.506590][T24426] ela_global-io: [name:report&]Read of size 8 at addr ffffff80c936a2f0 by task ela_global-io/24426 [ 1870.506607][T24426] ela_global-io: [name:report&] [ 1870.506634][T24426] ela_global-io: CPU: 0 PID: 24426 Comm: ela_global-io Tainted: P W O 5.10.168-android12-9-g8b5ca9694820-dirty #1 [ 1870.506651][T24426] ela_global-io: Hardware name: MT6879V_T/ZA (DT) [ 1870.506670][T24426] ela_global-io: Call trace: [ 1870.506701][T24426] ela_global-io: dump_backtrace+0x0/0x480 [ 1870.506722][T24426] ela_global-io: show_stack+0x1c/0x2c [ 1870.506745][T24426] ela_global-io: dump_stack_lvl+0x13c/0x190 [ 1870.506769][T24426] ela_global-io: print_address_description+0x80/0x2ac [ 1870.506791][T24426] ela_global-io: __kasan_report+0xf8/0x1a8 [ 1870.506811][T24426] ela_global-io: kasan_report+0x4c/0x88 [ 1870.506832][T24426] ela_global-io: __asan_report_load8_noabort+0x48/0x58 [ 1870.506856][T24426] ela_global-io: filemap_fault_cache_page+0x60/0x14c [moto_mmap_fault] [ 1870.506882][T24426] ela_global-io: __traceiter_android_vh_filemap_fault_cache_page+0x84/0xc0 [ 1870.506906][T24426] ela_global-io: filemap_fault+0x14e0/0x163c Change-Id: I915f54a5151a11284f828ae940c10b1e38b2460b Reviewed-on: https://gerrit.mot.com/2683986 SME-Granted: SME Approvals Granted SLTApproved: Slta Waiver Tested-by: Jira Key Reviewed-by: Zonghua Liu Reviewed-by: Zhangqing Huang Reviewed-by: Huosheng Liao Submit-Approved: Jira Key Reviewed-on: https://gerrit.mot.com/2700717 --- drivers/moto_mmap_fault/moto_mmap_fault.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/moto_mmap_fault/moto_mmap_fault.c b/drivers/moto_mmap_fault/moto_mmap_fault.c index ab09be5474c9..fc649a44245c 100644 --- a/drivers/moto_mmap_fault/moto_mmap_fault.c +++ b/drivers/moto_mmap_fault/moto_mmap_fault.c @@ -77,7 +77,7 @@ static void __nocfi filemap_fault_cache_page(void *p, struct vm_fault *vmf, stru if ((ra->ra_pages == max_ra_pages) && (vmf->android_oem_data1[0] != 0) && (vmf->android_oem_data1[1] == max_ra_pages)) { - ra->ra_pages = (unsigned long)vmf->android_oem_data1[0]; //restore the old ra_pages + ra->ra_pages = (unsigned int)vmf->android_oem_data1[0]; //restore the old ra_pages vmf->android_oem_data1[0] = 0; vmf->android_oem_data1[1] = 0; }