Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 9dc6488e authored by Li RongQing's avatar Li RongQing Committed by Dan Williams
Browse files

libnvdimm/pmem: fix a possible OOB access when read and write pmem 



If offset is not zero and length is bigger than PAGE_SIZE,
this will cause to out of boundary access to a page memory

Fixes: 98cc093c ("block, THP: make block_device_operations.rw_page support THP")
Co-developed-by: default avatarLiang ZhiCheng <liangzhicheng@baidu.com>
Signed-off-by: default avatarLiang ZhiCheng <liangzhicheng@baidu.com>
Signed-off-by: default avatarLi RongQing <lirongqing@baidu.com>
Reviewed-by: default avatarIra Weiny <ira.weiny@intel.com>
Reviewed-by: default avatarJeff Moyer <jmoyer@redhat.com>
Signed-off-by: default avatarDan Williams <dan.j.williams@intel.com>
parent d2e5b643

drivers/nvdimm/pmem.c

+4 −4
Original line number Diff line number Diff line
@@ -113,13 +113,13 @@ static void write_pmem(void *pmem_addr, struct page *page, 


	while (len) {

		mem = kmap_atomic(page);

		chunk = min_t(unsigned int, len, PAGE_SIZE);

		chunk = min_t(unsigned int, len, PAGE_SIZE - off);

		memcpy_flushcache(pmem_addr, mem + off, chunk);

		kunmap_atomic(mem);

		len -= chunk;

		off = 0;

		page++;

		pmem_addr += PAGE_SIZE;

		pmem_addr += chunk;

	}

}
@@ -132,7 +132,7 @@ static blk_status_t read_pmem(struct page *page, unsigned int off, 


	while (len) {

		mem = kmap_atomic(page);

		chunk = min_t(unsigned int, len, PAGE_SIZE);

		chunk = min_t(unsigned int, len, PAGE_SIZE - off);

		rem = memcpy_mcsafe(mem + off, pmem_addr, chunk);

		kunmap_atomic(mem);

		if (rem)
@@ -140,7 +140,7 @@ static blk_status_t read_pmem(struct page *page, unsigned int off, 
		len -= chunk;

		off = 0;

		page++;

		pmem_addr += PAGE_SIZE;

		pmem_addr += chunk;

	}

	return BLK_STS_OK;

}