On Tue, Aug 05, 2025 at 06:13:56PM +0200, Uladzislau Rezki wrote:
> I agree. Also it can be even moved under vmalloc.c. There is only one
> user which needs it globally, it is usercopy.c. It uses find_vmap_area()
> which is wrong. See:
>
> <snip>
> if (is_vmalloc_addr(ptr) && !pagefault_disabled()) {
> struct vmap_area *area = find_vmap_area(addr);
>
> if (!area)
> usercopy_abort("vmalloc", "no area", to_user, 0, n);
>
> if (n > area->va_end - addr) {
> offset = addr - area->va_start;
> usercopy_abort("vmalloc", NULL, to_user, offset, n);
> }
> return;
> }
> <snip>
>
> we can add a function which just assign va_start, va_end as input
> parameters and use them in the usercopy.c.
Yes please! I'd must rather use some exported validation routine than
having it hand-coded in usercopy.c. :)
--
Kees Cook
