summaryrefslogtreecommitdiffstats
path: root/arch
diff options
context:
space:
mode:
authorRalph Campbell <rcampbell@nvidia.com>2019-03-25 17:18:17 -0700
committerThomas Gleixner <tglx@linutronix.de>2019-03-28 14:13:51 +0100
commit92c77f7c4d5dfaaf45b2ce19360e69977c264766 (patch)
tree98f5532ac0b24f3d58237c7d43091ce4e9213ebd /arch
parenta9d57ef15cbe327fe54416dd194ee0ea66ae53a4 (diff)
downloadlinux-stable-92c77f7c4d5dfaaf45b2ce19360e69977c264766.tar.gz
linux-stable-92c77f7c4d5dfaaf45b2ce19360e69977c264766.tar.bz2
linux-stable-92c77f7c4d5dfaaf45b2ce19360e69977c264766.zip
x86/mm: Don't exceed the valid physical address space
valid_phys_addr_range() is used to sanity check the physical address range of an operation, e.g., access to /dev/mem. It uses __pa(high_memory) internally. If memory is populated at the end of the physical address space, then __pa(high_memory) is outside of the physical address space because: high_memory = (void *)__va(max_pfn * PAGE_SIZE - 1) + 1; For the comparison in valid_phys_addr_range() this is not an issue, but if CONFIG_DEBUG_VIRTUAL is enabled, __pa() maps to __phys_addr(), which verifies that the resulting physical address is within the valid physical address space of the CPU. So in the case that memory is populated at the end of the physical address space, this is not true and triggers a VIRTUAL_BUG_ON(). Use __pa(high_memory - 1) to prevent the conversion from going beyond the end of valid physical addresses. Fixes: be62a3204406 ("x86/mm: Limit mmap() of /dev/mem to valid physical addresses") Signed-off-by: Ralph Campbell <rcampbell@nvidia.com> Signed-off-by: Thomas Gleixner <tglx@linutronix.de> Cc: Craig Bergstrom <craigb@google.com> Cc: Linus Torvalds <torvalds@linux-foundation.org> Cc: Boris Ostrovsky <boris.ostrovsky@oracle.com> Cc: Fengguang Wu <fengguang.wu@intel.com> Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org> Cc: Hans Verkuil <hans.verkuil@cisco.com> Cc: Mauro Carvalho Chehab <mchehab@s-opensource.com> Cc: Peter Zijlstra <peterz@infradead.org> Cc: Sander Eikelenboom <linux@eikelenboom.it> Cc: Sean Young <sean@mess.org> Link: https://lkml.kernel.org/r/20190326001817.15413-2-rcampbell@nvidia.com
Diffstat (limited to 'arch')
-rw-r--r--arch/x86/mm/mmap.c2
1 files changed, 1 insertions, 1 deletions
diff --git a/arch/x86/mm/mmap.c b/arch/x86/mm/mmap.c
index db3165714521..dc726e07d8ba 100644
--- a/arch/x86/mm/mmap.c
+++ b/arch/x86/mm/mmap.c
@@ -230,7 +230,7 @@ bool mmap_address_hint_valid(unsigned long addr, unsigned long len)
/* Can we access it for direct reading/writing? Must be RAM: */
int valid_phys_addr_range(phys_addr_t addr, size_t count)
{
- return addr + count <= __pa(high_memory);
+ return addr + count - 1 <= __pa(high_memory - 1);
}
/* Can we access it through mmap? Must be a valid physical address: */