https://github.com/torvalds/linux
Revision b299cde245b0b76c977f4291162cf668e087b408 authored by Julius Werner on 12 May 2017, 21:42:58 UTC, committed by Greg Kroah-Hartman on 18 May 2017, 14:53:55 UTC
/dev/mem currently allows mmap() mappings that wrap around the end of
the physical address space, which should probably be illegal. It
circumvents the existing STRICT_DEVMEM permission check because the loop
immediately terminates (as the start address is already higher than the
end address). On the x86_64 architecture it will then cause a panic
(from the BUG(start >= end) in arch/x86/mm/pat.c:reserve_memtype()).

This patch adds an explicit check to make sure offset + size will not
wrap around in the physical address type.

Signed-off-by: Julius Werner <jwerner@chromium.org>
Cc: stable <stable@vger.kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
1 parent 0d83539
History
Tip revision: b299cde245b0b76c977f4291162cf668e087b408 authored by Julius Werner on 12 May 2017, 21:42:58 UTC
drivers: char: mem: Check for address space wraparound with mmap()
Tip revision: b299cde
File Mode Size
Documentation
arch
block
certs
crypto
drivers
firmware
fs
include
init
ipc
kernel
lib
mm
net
samples
scripts
security
sound
tools
usr
virt
.cocciconfig -rw-r--r-- 59 bytes
.get_maintainer.ignore -rw-r--r-- 31 bytes
.gitattributes -rw-r--r-- 30 bytes
.gitignore -rw-r--r-- 1.3 KB
.mailmap -rw-r--r-- 8.1 KB
COPYING -rw-r--r-- 18.3 KB
CREDITS -rw-r--r-- 96.2 KB
Kbuild -rw-r--r-- 2.2 KB
Kconfig -rw-r--r-- 252 bytes
MAINTAINERS -rw-r--r-- 397.6 KB
Makefile -rw-r--r-- 58.6 KB
README -rw-r--r-- 722 bytes

README

back to top