Skip to main content

Browse the archive

Revision 27de809a3d83a6199664479ebb19712533d6fd9b authored by Björn Töpel on 28 October 2021, 12:51:15 UTC, committed by Jakub Kicinski on 28 October 2021, 15:14:30 UTC 
riscv, bpf: Fix potential NULL dereference
 
The bpf_jit_binary_free() function requires a non-NULL argument. When
the RISC-V BPF JIT fails to converge in NR_JIT_ITERATIONS steps,
jit_data->header will be NULL, which triggers a NULL
dereference. Avoid this by checking the argument, prior calling the
function.

Fixes: ca6cb5447cec ("riscv, bpf: Factor common RISC-V JIT code")
Signed-off-by: Björn Töpel <bjorn@kernel.org>
Acked-by: Daniel Borkmann <daniel@iogearbox.net>
Link: https://lore.kernel.org/r/20211028125115.514587-1-bjorn@kernel.org
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
1 parent 20af886
Raw File
io-mapping.c 
// SPDX-License-Identifier: GPL-2.0-only

#include <linux/mm.h>
#include <linux/io-mapping.h>

/**
 * io_mapping_map_user - remap an I/O mapping to userspace
 * @iomap: the source io_mapping
 * @vma: user vma to map to
 * @addr: target user address to start at
 * @pfn: physical address of kernel memory
 * @size: size of map area
 *
 *  Note: this is only safe if the mm semaphore is held when called.
 */
int io_mapping_map_user(struct io_mapping *iomap, struct vm_area_struct *vma,
		unsigned long addr, unsigned long pfn, unsigned long size)
{
	vm_flags_t expected_flags = VM_PFNMAP | VM_DONTEXPAND | VM_DONTDUMP;

	if (WARN_ON_ONCE((vma->vm_flags & expected_flags) != expected_flags))
		return -EINVAL;

	/* We rely on prevalidation of the io-mapping to skip track_pfn(). */
	return remap_pfn_range_notrack(vma, addr, pfn, size,
		__pgprot((pgprot_val(iomap->prot) & _PAGE_CACHE_MASK) |
			 (pgprot_val(vma->vm_page_prot) & ~_PAGE_CACHE_MASK)));
}
EXPORT_SYMBOL_GPL(io_mapping_map_user);
back to top