|
Takashi Iwai |
e62ea3 |
From b49a0e69a7b1a68c8d3f64097d06dabb770fec96 Mon Sep 17 00:00:00 2001
|
|
Takashi Iwai |
e62ea3 |
From: Iwona Winiarska <iwona.winiarska@intel.com>
|
|
Takashi Iwai |
e62ea3 |
Date: Wed, 4 Aug 2021 01:48:18 +0200
|
|
Takashi Iwai |
e62ea3 |
Subject: [PATCH] soc: aspeed: lpc-ctrl: Fix boundary check for mmap
|
|
Takashi Iwai |
e62ea3 |
Git-commit: b49a0e69a7b1a68c8d3f64097d06dabb770fec96
|
|
Takashi Iwai |
e62ea3 |
Patch-mainline: v5.15-rc1
|
|
Takashi Iwai |
be54ca |
References: CVE-2021-42252 bsc#1190479 git-fixes stable-5.14.6
|
|
Takashi Iwai |
e62ea3 |
|
|
Takashi Iwai |
e62ea3 |
The check mixes pages (vm_pgoff) with bytes (vm_start, vm_end) on one
|
|
Takashi Iwai |
e62ea3 |
side of the comparison, and uses resource address (rather than just the
|
|
Takashi Iwai |
e62ea3 |
resource size) on the other side of the comparison.
|
|
Takashi Iwai |
e62ea3 |
This can allow malicious userspace to easily bypass the boundary check and
|
|
Takashi Iwai |
e62ea3 |
map pages that are located outside memory-region reserved by the driver.
|
|
Takashi Iwai |
e62ea3 |
|
|
Takashi Iwai |
e62ea3 |
Fixes: 6c4e97678501 ("drivers/misc: Add Aspeed LPC control driver")
|
|
Takashi Iwai |
e62ea3 |
Cc: stable@vger.kernel.org
|
|
Takashi Iwai |
e62ea3 |
Signed-off-by: Iwona Winiarska <iwona.winiarska@intel.com>
|
|
Takashi Iwai |
e62ea3 |
Reviewed-by: Andrew Jeffery <andrew@aj.id.au>
|
|
Takashi Iwai |
e62ea3 |
Tested-by: Andrew Jeffery <andrew@aj.id.au>
|
|
Takashi Iwai |
e62ea3 |
Reviewed-by: Joel Stanley <joel@aj.id.au>
|
|
Takashi Iwai |
e62ea3 |
Signed-off-by: Joel Stanley <joel@jms.id.au>
|
|
Takashi Iwai |
e62ea3 |
Acked-by: Takashi Iwai <tiwai@suse.de>
|
|
Takashi Iwai |
e62ea3 |
|
|
Takashi Iwai |
e62ea3 |
---
|
|
Takashi Iwai |
e62ea3 |
drivers/soc/aspeed/aspeed-lpc-ctrl.c | 2 +-
|
|
Takashi Iwai |
e62ea3 |
1 file changed, 1 insertion(+), 1 deletion(-)
|
|
Takashi Iwai |
e62ea3 |
|
|
Takashi Iwai |
e62ea3 |
diff --git a/drivers/soc/aspeed/aspeed-lpc-ctrl.c b/drivers/soc/aspeed/aspeed-lpc-ctrl.c
|
|
Takashi Iwai |
e62ea3 |
index c557ffd0992c..55e46fa6cf42 100644
|
|
Takashi Iwai |
e62ea3 |
--- a/drivers/soc/aspeed/aspeed-lpc-ctrl.c
|
|
Takashi Iwai |
e62ea3 |
+++ b/drivers/soc/aspeed/aspeed-lpc-ctrl.c
|
|
Takashi Iwai |
e62ea3 |
@@ -51,7 +51,7 @@ static int aspeed_lpc_ctrl_mmap(struct file *file, struct vm_area_struct *vma)
|
|
Takashi Iwai |
e62ea3 |
unsigned long vsize = vma->vm_end - vma->vm_start;
|
|
Takashi Iwai |
e62ea3 |
pgprot_t prot = vma->vm_page_prot;
|
|
Takashi Iwai |
e62ea3 |
|
|
Takashi Iwai |
e62ea3 |
- if (vma->vm_pgoff + vsize > lpc_ctrl->mem_base + lpc_ctrl->mem_size)
|
|
Takashi Iwai |
e62ea3 |
+ if (vma->vm_pgoff + vma_pages(vma) > lpc_ctrl->mem_size >> PAGE_SHIFT)
|
|
Takashi Iwai |
e62ea3 |
return -EINVAL;
|
|
Takashi Iwai |
e62ea3 |
|
|
Takashi Iwai |
e62ea3 |
/* ast2400/2500 AHB accesses are not cache coherent */
|
|
Takashi Iwai |
e62ea3 |
--
|
|
Takashi Iwai |
e62ea3 |
2.26.2
|
|
Takashi Iwai |
e62ea3 |
|