Re: [syzbot] [kernel?] BUG: unable to handle kernel paging request in write_comp_data

[Edward Adam Davis <eadavis@sina.com>]

From: Edward Aadm Davis <eadavis@sina.com>

#syz test: upstream 704340f1cd0d

diff --git a/kernel/kcov.c b/kernel/kcov.c
index 35420f0ac524..479a84921833 100644
--- a/kernel/kcov.c
+++ b/kernel/kcov.c
@@ -236,7 +236,7 @@ static void notrace write_comp_data(u64 type, u64 arg1, u64 arg2, u64 ip)
 {
 	struct task_struct *t;
 	u64 *area;
-	u64 count, start_index, end_pos, max_pos;
+	u64 count, start_index, end_pos, max_pos, tmp;
 
 	t = current;
 	if (!check_kcov_mode(KCOV_MODE_TRACE_CMP, t))
@@ -254,7 +254,9 @@ static void notrace write_comp_data(u64 type, u64 arg1, u64 arg2, u64 ip)
 	count = READ_ONCE(area[0]);
 
 	/* Every record is KCOV_WORDS_PER_CMP 64-bit words. */
-	start_index = 1 + count * KCOV_WORDS_PER_CMP;
+	if (check_mul_overflow(count, KCOV_WORDS_PER_CMP, &tmp))
+		return;
+	start_index = 1 + tmp;
 	end_pos = (start_index + KCOV_WORDS_PER_CMP) * sizeof(u64);
 	if (likely(end_pos <= max_pos)) {
 		/* See comment in __sanitizer_cov_trace_pc(). */