TWxSoftware/twx-linux
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

powerpc/powernv/memtrace: Fix out of bounds issue in memtrace mmap

Browse Source 
[ Upstream commit cd097df459 ]

memtrace mmap issue has an out of bounds issue. This patch fixes the by
checking that the requested mapping region size should stay within the
allocated region size.

Reported-by: Jonathan Greental <yonatan02greental@gmail.com>
Fixes: 08a022ad3d ("powerpc/powernv/memtrace: Allow mmaping trace buffers")
Signed-off-by: Ritesh Harjani (IBM) <ritesh.list@gmail.com>
Signed-off-by: Madhavan Srinivasan <maddy@linux.ibm.com>
Link: https://patch.msgid.link/20250610021227.361980-1-maddy@linux.ibm.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
This commit is contained in:
Ritesh Harjani (IBM)
2025-06-10 07:42:26 +05:30
committed by Greg Kroah-Hartman
parent b4e9bab601
commit 8635e325b8
1 changed files with 6 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
arch/powerpc/platforms/powernv/memtrace.c
+6 -2
View File
@@ -48,11 +48,15 @@ static ssize_t memtrace_read(struct file *filp, char __user *ubuf,
static int memtrace_mmap(struct file *filp, struct vm_area_struct *vma)
{
struct memtrace_entry *ent = filp->private_data;
unsigned long ent_nrpages = ent->size >> PAGE_SHIFT;
unsigned long vma_nrpages = vma_pages(vma);
if (ent->size < vma->vm_end - vma->vm_start)
/* The requested page offset should be within object's page count */
if (vma->vm_pgoff >= ent_nrpages)
return -EINVAL;
if (vma->vm_pgoff << PAGE_SHIFT >= ent->size)
/* The requested mapping range should remain within the bounds */
if (vma_nrpages > ent_nrpages - vma->vm_pgoff)
return -EINVAL;
vma->vm_page_prot = pgprot_noncached(vma->vm_page_prot);