pfn_valid can be wrong when parsing a invalid pfn whose phys address
exceeds BITS_PER_LONG as the MSB will be trimed when shifted.
The issue originally arise from bellowing call stack, which corresponding to
an access of the /proc/kpageflags from userspace with a invalid pfn parameter
and leads to kernel panic.
[46886.723249] c7 [<
c031ff98>] (stable_page_flags) from [<
c03203f8>]
[46886.723264] c7 [<
c0320368>] (kpageflags_read) from [<
c0312030>]
[46886.723280] c7 [<
c0311fb0>] (proc_reg_read) from [<
c02a6e6c>]
[46886.723290] c7 [<
c02a6e24>] (__vfs_read) from [<
c02a7018>]
[46886.723301] c7 [<
c02a6f74>] (vfs_read) from [<
c02a778c>]
[46886.723315] c7 [<
c02a770c>] (SyS_pread64) from [<
c0108620>]
(ret_fast_syscall+0x0/0x28)
Signed-off-by: Zhaoyang Huang <zhaoyang.huang@unisoc.com>
Signed-off-by: Russell King <rmk+kernel@armlinux.org.uk>
#ifdef CONFIG_HAVE_ARCH_PFN_VALID
int pfn_valid(unsigned long pfn)
{
+ phys_addr_t addr = __pfn_to_phys(pfn);
+
+ if (__phys_to_pfn(addr) != pfn)
+ return 0;
+
return memblock_is_map_memory(__pfn_to_phys(pfn));
}
EXPORT_SYMBOL(pfn_valid);