Re: [PATCH] mm: actually remap enough memory

[Andrew Morton <akpm@linux-foundation.org>]

On Sun,  8 Feb 2015 04:55:12 +0200 Grazvydas Ignotas <notasas@gmail.com> wrote:

> For whatever reason, generic_access_phys() only remaps one page, but
> actually allows to access arbitrary size. It's quite easy to trigger
> large reads, like printing out large structure with gdb, which leads to
> a crash. Fix it by remapping correct size.
> 
> ...
>
> --- a/mm/memory.c
> +++ b/mm/memory.c
> @@ -3829,7 +3829,7 @@ int generic_access_phys(struct vm_area_struct *vma, unsigned long addr,
>  	if (follow_phys(vma, addr, write, &prot, &phys_addr))
>  		return -EINVAL;
>  
> -	maddr = ioremap_prot(phys_addr, PAGE_SIZE, prot);
> +	maddr = ioremap_prot(phys_addr, PAGE_ALIGN(len + offset), prot);
>  	if (write)
>  		memcpy_toio(maddr + offset, buf, len);
>  	else

hm, shouldn't this be PAGE_ALIGN(len)?

Do we need the PAGE_ALIGN at all?  It's probably safer/saner to have it
there, but x86 (at least) should be OK with arbitrary alignment on both
addr and len?

--
To unsubscribe, send a message with 'unsubscribe linux-mm' in
the body to majordomo@kvack.org.  For more info on Linux MM,
see: http://www.linux-mm.org/ .
Don't email: <a href=mailto:"dont@kvack.org"> email@kvack.org </a>