mirrors/linux
2
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git synced 2026-05-10 11:40:19 -04:00
Code Issues Packages Projects Releases Wiki Activity

powerpc/powernv/memtrace: Fix out of bounds issue in memtrace mmap

Browse Source 
memtrace mmap issue has an out of bounds issue. This patch fixes the by
checking that the requested mapping region size should stay within the
allocated region size.

Reported-by: Jonathan Greental <yonatan02greental@gmail.com>
Fixes: 08a022ad3d ("powerpc/powernv/memtrace: Allow mmaping trace buffers")
Signed-off-by: Ritesh Harjani (IBM) <ritesh.list@gmail.com>
Signed-off-by: Madhavan Srinivasan <maddy@linux.ibm.com>
Link: https://patch.msgid.link/20250610021227.361980-1-maddy@linux.ibm.com
This commit is contained in:
Ritesh Harjani (IBM)
2025-06-10 07:42:26 +05:30
committed by Madhavan Srinivasan
parent 19272b37aa
commit cd097df459
1 changed files with 6 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

8
arch/powerpc/platforms/powernv/memtrace.c
View File

@@ -48,11 +48,15 @@ static ssize_t memtrace_read(struct file *filp, char __user *ubuf,
static int memtrace_mmap(struct file *filp, struct vm_area_struct *vma)
{
struct memtrace_entry *ent = filp->private_data;
unsigned long ent_nrpages = ent->size >> PAGE_SHIFT;
unsigned long vma_nrpages = vma_pages(vma);
if (ent->size < vma->vm_end - vma->vm_start)
/* The requested page offset should be within object's page count */
if (vma->vm_pgoff >= ent_nrpages)
return -EINVAL;
if (vma->vm_pgoff << PAGE_SHIFT >= ent->size)
/* The requested mapping range should remain within the bounds */
if (vma_nrpages > ent_nrpages - vma->vm_pgoff)
return -EINVAL;
vma->vm_page_prot = pgprot_noncached(vma->vm_page_prot);