tree c55077887a961776bcf70c30967fde0146f5162d
parent 6e1b0386ffa810c58aaed22ac24a0e187bc9d8dc
author Barret Rhoden <brho@cs.berkeley.edu> 1551890849 -0500
committer Barret Rhoden <brho@cs.berkeley.edu> 1551890849 -0500

Check event_queue pointer addresses

We had a couple checks in send_event(), mostly warnings and prints.
This commit changes those warnings to one panic, and pushes the error
handling closer to userspace.

Note that there's not much we can do about a bad pointer in a syscall
struct, other than "silently" fail.  It's almost always a bad user bug,
hence the informational print.

Also note that the kernel can still fault on an unmapped, paged out
address in userspace.  None of that is sorted.  This is just the sanity
checks to make sure we aren't give a kernel pointer.  It also catches
any very low pointers, below the MMAP_LIM.  (So null pointers and
friends).

Reported-by: syzbot+ab67ae285c93a8d288a7@syzkaller.appspotmail.com
Signed-off-by: Barret Rhoden <brho@cs.berkeley.edu>