• Robin Murphy's avatar
    drivers: char: mem: Fix thinkos in kmem address checks · 488debb9
    Robin Murphy authored
    When borrowing the pfn_valid() check from mmap_kmem(), somebody managed
    to get physical and virtual addresses spectacularly muddled up, such
    that we've ended up with checks for one being the other. Whilst this
    does indeed prevent out-of-bounds accesses crashing, on most systems
    it also prevents the more desirable use-case of working at all ever.
    
    Check the *virtual* offset correctly for what it is. Furthermore, do
    so in the right place - a read or write may span multiple pages, so a
    single up-front check is insufficient. High memory accesses already
    have a similar validity check just before the copy_to_user() call, so
    just make the low memory path fully consistent with that.
    Reported-by: default avatarJason A. Donenfeld <Jason@zx2c4.com>
    CC: stable@vger.kernel.org
    Fixes: 148a1bc8 ("drivers: char: mem: Check {read,write}_kmem() addresses")
    Signed-off-by: default avatarRobin Murphy <robin.murphy@arm.com>
    Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
    488debb9
mem.c 19.1 KB