[lkml]   [2017]   [Sep]   [9]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
Messages in this thread
    Patch in this message
    Subject[PATCH 3.16 114/233] drivers: char: mem: Fix wraparound check to allow mappings up to the end
    3.16.48-rc1 review patch.  If anyone has any objections, please let me know.


    From: Julius Werner <>

    commit 32829da54d9368103a2f03269a5120aa9ee4d5da upstream.

    A recent fix to /dev/mem prevents mappings from wrapping around the end
    of physical address space. However, the check was written in a way that
    also prevents a mapping reaching just up to the end of physical address
    space, which may be a valid use case (especially on 32-bit systems).
    This patch fixes it by checking the last mapped address (instead of the
    first address behind that) for overflow.

    Fixes: b299cde245 ("drivers: char: mem: Check for address space wraparound with mmap()")
    Reported-by: Nico Huber <>
    Signed-off-by: Julius Werner <>
    Signed-off-by: Greg Kroah-Hartman <>
    Signed-off-by: Ben Hutchings <>
    drivers/char/mem.c | 2 +-
    1 file changed, 1 insertion(+), 1 deletion(-)

    --- a/drivers/char/mem.c
    +++ b/drivers/char/mem.c
    @@ -332,7 +332,7 @@ static int mmap_mem(struct file *file, s
    phys_addr_t offset = (phys_addr_t)vma->vm_pgoff << PAGE_SHIFT;

    /* It's illegal to wrap around the end of the physical address space. */
    - if (offset + (phys_addr_t)size < offset)
    + if (offset + (phys_addr_t)size - 1 < offset)
    return -EINVAL;

    if (!valid_mmap_phys_addr_range(vma->vm_pgoff, size))
     \ /
      Last update: 2017-09-10 01:15    [W:2.933 / U:0.840 seconds]
    ©2003-2018 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site