mm: LKSM: bug fix for KASAN out-of-bound access error on accessing a filter

KASAN reports out-of-bound accesses (reported by Jaehoon Chung)
on slab which is performed for obtaining a next filtered
address to find a sharable page.

LKSM exploits bitmap-based filters to find sharable pages in
an efficient way. A buggy code is a kind of miscalculation for
boundary of the allocated bitmap. This patch takes care of it.

Change-Id: If45c5ce175db067523b60f11e69e12d2bc798659
Signed-off-by: Sung-hun Kim <sfoon.kim@samsung.com>

diff --git a/mm/lksm.c b/mm/lksm.c
index e6a1533..ee5598b 100644 (file)
--- a/mm/lksm.c
+++ b/mm/lksm.c
@@ -2914,7 +2914,7 @@ static void lksm_insert_mm_slot_ordered(struct mm_slot *slot)
 static inline void __lksm_copy_filter
 (unsigned long *orig, unsigned long *newer, int size)
 {
-       while (size-- >= 0)
+       while (--size >= 0)
                *(newer++) = *(orig++);
 }
 
@@ -3009,8 +3009,8 @@ static inline unsigned long lksm_get_next_filtered_address
        unsigned long next_offset, curr_offset, nbits;
 
        curr_offset = (addr - base) >> PAGE_SHIFT;
-       nbits = (region->len == 0) ? BITS_PER_LONG :
-                               (region->len << (6 + PAGE_SHIFT));
+       nbits = region->len * BITS_PER_LONG;
+
        if (region->len > SINGLE_FILTER_LEN)
                next_offset = find_next_bit(region->filter, nbits, curr_offset);
        else