• Petr Tesarik's avatar
    /dev/mem: handle out-of-bounds read/write · 08d2d00b
    Petr Tesarik authored
    The loff_t type may be wider than phys_addr_t (e.g. on 32-bit systems).
    Consequently, the file offset may be truncated in the assignment.
    Currently, /dev/mem wraps around, which may cause applications to read
    or write incorrect regions of memory by accident.
    
    Let's follow POSIX file semantics here and return 0 when reading from
    and -EFBIG when writing to an offset that cannot be represented by a
    phys_addr_t.
    
    Note that the conditional is optimized out by the compiler if loff_t
    has the same size as phys_addr_t.
    Signed-off-by: default avatarPetr Tesarik <ptesarik@suse.cz>
    Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
    08d2d00b
mem.c 19 KB