Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 488debb9 authored by Robin Murphy's avatar Robin Murphy Committed by Greg Kroah-Hartman
Browse files

drivers: char: mem: Fix thinkos in kmem address checks 



When borrowing the pfn_valid() check from mmap_kmem(), somebody managed
to get physical and virtual addresses spectacularly muddled up, such
that we've ended up with checks for one being the other. Whilst this
does indeed prevent out-of-bounds accesses crashing, on most systems
it also prevents the more desirable use-case of working at all ever.

Check the *virtual* offset correctly for what it is. Furthermore, do
so in the right place - a read or write may span multiple pages, so a
single up-front check is insufficient. High memory accesses already
have a similar validity check just before the copy_to_user() call, so
just make the low memory path fully consistent with that.

Reported-by: default avatarJason A. Donenfeld <Jason@zx2c4.com>
CC: stable@vger.kernel.org
Fixes: 148a1bc8 ("drivers: char: mem: Check {read,write}_kmem() addresses")
Signed-off-by: default avatarRobin Murphy <robin.murphy@arm.com>
Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
parent 7ee7f45a

drivers/char/mem.c

+4 −6
Original line number Diff line number Diff line
@@ -381,9 +381,6 @@ static ssize_t read_kmem(struct file *file, char __user *buf, 
	char *kbuf; /* k-addr because vread() takes vmlist_lock rwlock */

	int err = 0;



	if (!pfn_valid(PFN_DOWN(p)))

		return -EIO;



	read = 0;

	if (p < (unsigned long) high_memory) {

		low_count = count;
@@ -412,6 +409,8 @@ static ssize_t read_kmem(struct file *file, char __user *buf, 
			 * by the kernel or data corruption may occur

			 */

			kbuf = xlate_dev_kmem_ptr((void *)p);

			if (!virt_addr_valid(kbuf))

				return -ENXIO;



			if (copy_to_user(buf, kbuf, sz))

				return -EFAULT;
@@ -482,6 +481,8 @@ static ssize_t do_write_kmem(unsigned long p, const char __user *buf, 
		 * corruption may occur.

		 */

		ptr = xlate_dev_kmem_ptr((void *)p);

		if (!virt_addr_valid(ptr))

			return -ENXIO;



		copied = copy_from_user(ptr, buf, sz);

		if (copied) {
@@ -512,9 +513,6 @@ static ssize_t write_kmem(struct file *file, const char __user *buf, 
	char *kbuf; /* k-addr because vwrite() takes vmlist_lock rwlock */

	int err = 0;



	if (!pfn_valid(PFN_DOWN(p)))

		return -EIO;



	if (p < (unsigned long) high_memory) {

		unsigned long to_write = min_t(unsigned long, count,

					       (unsigned long)high_memory - p);