linux/drivers/mtd
Linus Torvalds 9c603e53d3 mtdchar: fix offset overflow detection
Sasha Levin has been running trinity in a KVM tools guest, and was able
to trigger the BUG_ON() at arch/x86/mm/pat.c:279 (verifying the range of
the memory type).  The call trace showed that it was mtdchar_mmap() that
created an invalid remap_pfn_range().

The problem is that mtdchar_mmap() does various really odd and subtle
things with the vma page offset etc, and uses the wrong types (and the
wrong overflow) detection for it.

For example, the page offset may well be 32-bit on a 32-bit
architecture, but after shifting it up by PAGE_SHIFT, we need to use a
potentially 64-bit resource_size_t to correctly hold the full value.

Also, we need to check that the vma length plus offset doesn't overflow
before we check that it is smaller than the length of the mtdmap region.

This fixes things up and tries to make the code a bit easier to read.

Reported-and-tested-by: Sasha Levin <levinsasha928@gmail.com>
Acked-by: Suresh Siddha <suresh.b.siddha@intel.com>
Acked-by: Artem Bityutskiy <dedekind1@gmail.com>
Cc: David Woodhouse <dwmw2@infradead.org>
Cc: linux-mtd@lists.infradead.org
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
2012-09-28 12:13:46 -07:00
..
chips mtd: cfi_cmdset_0002: Slight cleanup of fixup messages 2012-05-13 23:34:36 -05:00
devices - More robust parsing especially of xattr data in JFFS2 2012-06-01 16:55:42 -07:00
lpddr mtd: lpddr: replace open-coded ARRAY_SIZE with macro 2012-05-13 22:47:31 -05:00
maps mtd/uclinux: Use generic __bss_stop instead of _ebss 2012-06-27 09:59:43 +02:00
nand Merge branch 'testing/new-warnings' into fixes 2012-08-10 12:28:57 +02:00
onenand mtd: driver _read() returns max_bitflips; mtd_read() returns -EUCLEAN 2012-05-13 23:14:23 -05:00
tests mtd: introduce mtd_can_have_bb helper 2012-01-09 18:26:24 +00:00
ubi UBI: fix a horrible memory deallocation bug 2012-09-04 09:40:26 +03:00
afs.c mtd: introduce mtd_read interface 2012-01-09 18:25:19 +00:00
ar7part.c mtd: introduce mtd_read interface 2012-01-09 18:25:19 +00:00
bcm63xxpart.c mtd: bcm63xxpart: handle Broadcom partition order 2012-05-13 22:55:03 -05:00
cmdlinepart.c mtd: cmdlinepart: fix commentary 2012-05-13 23:03:36 -05:00
ftl.c mtd: do not use mtd->sync directly 2012-01-09 18:26:21 +00:00
inftlcore.c mtd: add leading underscore to all mtd functions 2012-03-27 00:20:01 +01:00
inftlmount.c mtd: introduce mtd_block_markbad interface 2012-01-09 18:25:48 +00:00
Kconfig mtd: of_parts: fix breakage in Kconfig 2012-06-01 20:06:59 +01:00
Makefile mtd: maps: bcm963xx-flash: make CFE partition parsing an mtd parser 2012-01-09 18:15:31 +00:00
mtd_blkdevs.c mtd: mtdblock: call mtd_sync() only if opened for write 2012-03-27 00:11:11 +01:00
mtdblock_ro.c mtd: introduce mtd_write interface 2012-01-09 18:25:20 +00:00
mtdblock.c mtd: mtdblock: call mtd_sync() only if opened for write 2012-03-27 00:11:11 +01:00
mtdchar.c mtdchar: fix offset overflow detection 2012-09-28 12:13:46 -07:00
mtdconcat.c mtd: unify initialization of erase_info->fail_addr 2012-03-27 01:02:24 +01:00
mtdcore.c mtd: driver _read() returns max_bitflips; mtd_read() returns -EUCLEAN 2012-05-13 23:14:23 -05:00
mtdcore.h
mtdoops.c kmsg - kmsg_dump() use iterator to receive log buffer content 2012-06-15 14:53:59 -07:00
mtdpart.c mtd: driver _read() returns max_bitflips; mtd_read() returns -EUCLEAN 2012-05-13 23:14:23 -05:00
mtdsuper.c VFS: Pass mount flags to sget() 2012-07-14 16:38:34 +04:00
mtdswap.c mtd: do not use mtd->block_markbad directly 2012-01-09 18:26:26 +00:00
nftlcore.c mtd: nftlcore: remove out-of-date and now irrelevant piece of code 2012-03-27 00:24:03 +01:00
nftlmount.c mtd: introduce mtd_block_markbad interface 2012-01-09 18:25:48 +00:00
ofpart.c
redboot.c mtd: redboot: remove useless code 2012-03-27 00:24:14 +01:00
rfd_ftl.c mtd: do not use mtd->sync directly 2012-01-09 18:26:21 +00:00
sm_ftl.c mtd: sm_ftl: fix typo in major number. 2012-03-27 01:01:26 +01:00
sm_ftl.h
ssfdc.c mtd: introduce mtd_block_isbad interface 2012-01-09 18:25:47 +00:00