TWxSoftware/twx-linux
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Merge tag 'powerpc-6.16-2' of git://git.kernel.org/pub/scm/linux/kernel/git/powerpc/linux

Browse Source 
Pull powerpc fixes from Madhavan Srinivasan:

 - a couple of fixes for out of bounds issues in memtrace and vas

Thanks to Ritesh Harjani (IBM), Haren Myneni, and Jonathan Greental

* tag 'powerpc-6.16-2' of git://git.kernel.org/pub/scm/linux/kernel/git/powerpc/linux:
  powerpc/vas: Return -EINVAL if the offset is non-zero in mmap()
  powerpc/powernv/memtrace: Fix out of bounds issue in memtrace mmap
This commit is contained in:
Linus Torvalds
2025-06-09 20:06:58 -07:00
parent 19272b37aa 0d67f0dee6
commit f09079bd04
2 changed files with 15 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
arch/powerpc/platforms/book3s/vas-api.c
+9
View File
@@ -521,6 +521,15 @@ static int coproc_mmap(struct file *fp, struct vm_area_struct *vma)
return -EINVAL;
}
/*
* Map complete page to the paste address. So the user
* space should pass 0ULL to the offset parameter.
*/
if (vma->vm_pgoff) {
pr_debug("Page offset unsupported to map paste address\n");
return -EINVAL;
}
/* Ensure instance has an open send window */
if (!txwin) {
pr_err("No send window open?\n");
arch/powerpc/platforms/powernv/memtrace.c
+6 -2
View File
@@ -48,11 +48,15 @@ static ssize_t memtrace_read(struct file *filp, char __user *ubuf,
static int memtrace_mmap(struct file *filp, struct vm_area_struct *vma)
{
struct memtrace_entry *ent = filp->private_data;
unsigned long ent_nrpages = ent->size >> PAGE_SHIFT;
unsigned long vma_nrpages = vma_pages(vma);
if (ent->size < vma->vm_end - vma->vm_start)
/* The requested page offset should be within object's page count */
if (vma->vm_pgoff >= ent_nrpages)
return -EINVAL;
if (vma->vm_pgoff << PAGE_SHIFT >= ent->size)
/* The requested mapping range should remain within the bounds */
if (vma_nrpages > ent_nrpages - vma->vm_pgoff)
return -EINVAL;
vma->vm_page_prot = pgprot_noncached(vma->vm_page_prot);