]> git.ipfire.org Git - thirdparty/kernel/stable.git/commit
soc: aspeed: lpc-ctrl: Fix boundary check for mmap
authorIwona Winiarska <iwona.winiarska@intel.com>
Tue, 3 Aug 2021 23:48:18 +0000 (01:48 +0200)
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Sat, 18 Sep 2021 11:40:07 +0000 (13:40 +0200)
commit3fdf2feb6cbe76c6867224ed8527b356e805352c
treeec6c9f37fe681169e9cff974ce14a2711bda12ee
parente80c45dbe263b2b5d372a76b802ef3ef89f2b35f
soc: aspeed: lpc-ctrl: Fix boundary check for mmap

commit b49a0e69a7b1a68c8d3f64097d06dabb770fec96 upstream.

The check mixes pages (vm_pgoff) with bytes (vm_start, vm_end) on one
side of the comparison, and uses resource address (rather than just the
resource size) on the other side of the comparison.
This can allow malicious userspace to easily bypass the boundary check and
map pages that are located outside memory-region reserved by the driver.

Fixes: 6c4e97678501 ("drivers/misc: Add Aspeed LPC control driver")
Cc: stable@vger.kernel.org
Signed-off-by: Iwona Winiarska <iwona.winiarska@intel.com>
Reviewed-by: Andrew Jeffery <andrew@aj.id.au>
Tested-by: Andrew Jeffery <andrew@aj.id.au>
Reviewed-by: Joel Stanley <joel@aj.id.au>
Signed-off-by: Joel Stanley <joel@jms.id.au>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
drivers/soc/aspeed/aspeed-lpc-ctrl.c