Commit 580218f9 authored by Russell King's avatar Russell King
Browse files

ARM: mm: fix set_memory_*() bounds checks 



The set_memory_*() bounds checks are buggy on several fronts:

1. They fail to round the region size up if the passed address is not
   page aligned.
2. The region check was incomplete, and didn't correspond with what
   was being asked of apply_to_page_range()

So, rework change_memory_common() to fix these problems, adding an
"in_region()" helper to determine whether the start & size fit within
the provided region start and stop addresses.

Signed-off-by: default avatarRussell King <rmk+kernel@armlinux.org.uk>
parent a85b2257

arch/arm/mm/pageattr.c

+13 −13
Original line number Diff line number Diff line
@@ -34,28 +34,28 @@ static int change_page_range(pte_t *ptep, pgtable_t token, unsigned long addr, 
	return 0;

}



static bool in_range(unsigned long start, unsigned long size,

	unsigned long range_start, unsigned long range_end)

{

	return start >= range_start && start < range_end &&

		size <= range_end - start;

}



static int change_memory_common(unsigned long addr, int numpages,

				pgprot_t set_mask, pgprot_t clear_mask)

{

	unsigned long start = addr;

	unsigned long size = PAGE_SIZE*numpages;

	unsigned long end = start + size;

	unsigned long start = addr & PAGE_MASK;

	unsigned long end = PAGE_ALIGN(addr) + numpages * PAGE_SIZE;

	unsigned long size = end - start;

	int ret;

	struct page_change_data data;



	if (!IS_ALIGNED(addr, PAGE_SIZE)) {

		start &= PAGE_MASK;

		end = start + size;

		WARN_ON_ONCE(1);

	}

	WARN_ON_ONCE(start != addr);



	if (!numpages)

	if (!size)

		return 0;



	if (start < MODULES_VADDR || start >= MODULES_END)

		return -EINVAL;



	if (end < MODULES_VADDR || start >= MODULES_END)

	if (!in_range(start, size, MODULES_VADDR, MODULES_END))

		return -EINVAL;



	data.set_mask = set_mask;

CRA Git | Maintained and supported by SUSTech CRA and CCSE