]>
Commit | Line | Data |
---|---|---|
6c9f6d29 GKH |
1 | From 974d4d03fc020af4fa4e9e72a86f0fefa37803c5 Mon Sep 17 00:00:00 2001 |
2 | From: Stefan Wahren <stefan.wahren@i2se.com> | |
3 | Date: Sun, 3 Sep 2017 19:06:31 +0200 | |
4 | Subject: staging: vchiq_2835_arm: Fix NULL ptr dereference in free_pagelist | |
5 | ||
6 | From: Stefan Wahren <stefan.wahren@i2se.com> | |
7 | ||
8 | commit 974d4d03fc020af4fa4e9e72a86f0fefa37803c5 upstream. | |
9 | ||
10 | This fixes a NULL pointer dereference on RPi 2 with multi_v7_defconfig. | |
11 | The function page_address() could return NULL with enabled CONFIG_HIGHMEM. | |
12 | So fix this by using kmap() instead. | |
13 | ||
14 | Signed-off-by: Stefan Wahren <stefan.wahren@i2se.com> | |
15 | Fixes: 71bad7f08641 ("staging: add bcm2708 vchiq driver") | |
16 | Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> | |
17 | ||
18 | --- | |
19 | drivers/staging/vc04_services/interface/vchiq_arm/vchiq_2835_arm.c | 6 ++++-- | |
20 | 1 file changed, 4 insertions(+), 2 deletions(-) | |
21 | ||
22 | --- a/drivers/staging/vc04_services/interface/vchiq_arm/vchiq_2835_arm.c | |
23 | +++ b/drivers/staging/vc04_services/interface/vchiq_arm/vchiq_2835_arm.c | |
24 | @@ -612,18 +612,20 @@ free_pagelist(struct vchiq_pagelist_info | |
25 | if (head_bytes > actual) | |
26 | head_bytes = actual; | |
27 | ||
28 | - memcpy((char *)page_address(pages[0]) + | |
29 | + memcpy((char *)kmap(pages[0]) + | |
30 | pagelist->offset, | |
31 | fragments, | |
32 | head_bytes); | |
33 | + kunmap(pages[0]); | |
34 | } | |
35 | if ((actual >= 0) && (head_bytes < actual) && | |
36 | (tail_bytes != 0)) { | |
37 | - memcpy((char *)page_address(pages[num_pages - 1]) + | |
38 | + memcpy((char *)kmap(pages[num_pages - 1]) + | |
39 | ((pagelist->offset + actual) & | |
40 | (PAGE_SIZE - 1) & ~(g_cache_line_size - 1)), | |
41 | fragments + g_cache_line_size, | |
42 | tail_bytes); | |
43 | + kunmap(pages[num_pages - 1]); | |
44 | } | |
45 | ||
46 | down(&g_free_fragments_mutex); |