[PATCH] kcov: add a missing bound check in write_comp_data()

[Edward Adam Davis]

A missing bounds check in write_comp_data() can lead to an out-of-bounds read
or write in the adjacent memory area, since the start_index is not validated
before accessing area[] in the function later, potentially hitting:

BUG: unable to handle page fault for address: ffffc90003792fe8
RIP: 0010:write_comp_data+0x7c/0xa0 kernel/kcov.c:263
Call Trace:
 __do_sys_rseq kernel/rseq.c:549 [inline]
 __se_sys_rseq kernel/rseq.c:547 [inline]
 __x64_sys_rseq+0xc2/0x2e0 kernel/rseq.c:547

Fixes: ded97d2c2b2c ("kcov: support comparison operands collection")
Reported-by: syzbot+237f670105a254a230d4@xxxxxxxxxxxxxxxxxxxxxxxxx
Closes: https://syzkaller.appspot.com/bug?extid=237f670105a254a230d4
Tested-by: syzbot+237f670105a254a230d4@xxxxxxxxxxxxxxxxxxxxxxxxx
Signed-off-by: Edward Adam Davis <eadavis@xxxxxxxx>
---
 kernel/kcov.c | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/kernel/kcov.c b/kernel/kcov.c
index 35420f0ac524..479a84921833 100644
--- a/kernel/kcov.c
+++ b/kernel/kcov.c
@@ -236,7 +236,7 @@ static void notrace write_comp_data(u64 type, u64 arg1, u64 arg2, u64 ip)
 {
 	struct task_struct *t;
 	u64 *area;
-	u64 count, start_index, end_pos, max_pos;
+	u64 count, start_index, end_pos, max_pos, tmp;
 
 	t = current;
 	if (!check_kcov_mode(KCOV_MODE_TRACE_CMP, t))
@@ -254,7 +254,9 @@ static void notrace write_comp_data(u64 type, u64 arg1, u64 arg2, u64 ip)
 	count = READ_ONCE(area[0]);
 
 	/* Every record is KCOV_WORDS_PER_CMP 64-bit words. */
-	start_index = 1 + count * KCOV_WORDS_PER_CMP;
+	if (check_mul_overflow(count, KCOV_WORDS_PER_CMP, &tmp))
+		return;
+	start_index = 1 + tmp;
 	end_pos = (start_index + KCOV_WORDS_PER_CMP) * sizeof(u64);
 	if (likely(end_pos <= max_pos)) {
 		/* See comment in __sanitizer_cov_trace_pc(). */
-- 
2.43.0