• Linus Torvalds's avatar
    mtdchar: fix offset overflow detection · 9c603e53
    Linus Torvalds authored
    Sasha Levin has been running trinity in a KVM tools guest, and was able
    to trigger the BUG_ON() at arch/x86/mm/pat.c:279 (verifying the range of
    the memory type).  The call trace showed that it was mtdchar_mmap() that
    created an invalid remap_pfn_range().
    
    The problem is that mtdchar_mmap() does various really odd and subtle
    things with the vma page offset etc, and uses the wrong types (and the
    wrong overflow) detection for it.
    
    For example, the page offset may well be 32-bit on a 32-bit
    architecture, but after shifting it up by PAGE_SHIFT, we need to use a
    potentially 64-bit resource_size_t to correctly hold the full value.
    
    Also, we need to check that the vma length plus offset doesn't overflow
    before we check that it is smaller than the length of the mtdmap region.
    
    This fixes things up and tries to make the code a bit easier to read.
    Reported-and-tested-by: default avatarSasha Levin <levinsasha928@gmail.com>
    Acked-by: default avatarSuresh Siddha <suresh.b.siddha@intel.com>
    Acked-by: default avatarArtem Bityutskiy <dedekind1@gmail.com>
    Cc: David Woodhouse <dwmw2@infradead.org>
    Cc: linux-mtd@lists.infradead.org
    Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
    9c603e53
mtdchar.c 28 KB