From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-9.1 required=3.0 tests=DKIMWL_WL_HIGH,DKIM_SIGNED, DKIM_VALID,DKIM_VALID_AU,INCLUDES_PATCH,MAILING_LIST_MULTI,SIGNED_OFF_BY, SPF_PASS,URIBL_BLOCKED,USER_AGENT_GIT autolearn=ham autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id BDC8DC282CE for ; Mon, 22 Apr 2019 20:00:42 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.kernel.org (Postfix) with ESMTP id 8C47C2075A for ; Mon, 22 Apr 2019 20:00:42 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1555963242; bh=ZHd8cY/Lekvr3XmOT7i7yQqXMLCCVCE0JV36ZwjVrZ8=; h=From:To:Cc:Subject:Date:In-Reply-To:References:List-ID:From; b=M5XngO6bv10Jm7YkBk/70kX33i1v7zoPaT4m+Zce1IWuQ/hJAaCrMce/q325U92XW UDeVL2J8Z2Ti5tWNk9vnM9k+O/oReo5f55ASRaDt9VzDDqk0BkRdu3wCIUY03lcex4 88yycalUyhCNfRpkLBv8L0/wfv+DCFpP1GkoQZ4s= Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1730212AbfDVTrO (ORCPT ); Mon, 22 Apr 2019 15:47:14 -0400 Received: from mail.kernel.org ([198.145.29.99]:49878 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1730184AbfDVTrM (ORCPT ); Mon, 22 Apr 2019 15:47:12 -0400 Received: from sasha-vm.mshome.net (c-73-47-72-35.hsd1.nh.comcast.net [73.47.72.35]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPSA id 98E06218D9; Mon, 22 Apr 2019 19:47:09 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1555962431; bh=ZHd8cY/Lekvr3XmOT7i7yQqXMLCCVCE0JV36ZwjVrZ8=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=OxtItNq0eKrunVoIvbpABLzHvb7t5U7tDaEjPRzFladd8WQkvWnUvEBeEPuTKkNRi Bz6Ust/hjyyhEOJulCBC8y1W8Up+pA2duH8sHgroIfrhtZr3wu6SpugWhU9Qd8DgXY C1aF/3XzFuyekZ+uVTmz/XFq6MjSisu5PYe21B54= From: Sasha Levin To: linux-kernel@vger.kernel.org, stable@vger.kernel.org Cc: Ralph Campbell , Thomas Gleixner , Craig Bergstrom , Linus Torvalds , Boris Ostrovsky , Fengguang Wu , Greg Kroah-Hartman , Hans Verkuil , Mauro Carvalho Chehab , Peter Zijlstra , Sander Eikelenboom , Sean Young , Sasha Levin Subject: [PATCH AUTOSEL 4.19 59/68] x86/mm: Don't exceed the valid physical address space Date: Mon, 22 Apr 2019 15:45:07 -0400 Message-Id: <20190422194516.11634-59-sashal@kernel.org> X-Mailer: git-send-email 2.19.1 In-Reply-To: <20190422194516.11634-1-sashal@kernel.org> References: <20190422194516.11634-1-sashal@kernel.org> MIME-Version: 1.0 X-stable: review X-Patchwork-Hint: Ignore Content-Transfer-Encoding: 8bit Sender: linux-kernel-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org From: Ralph Campbell [ Upstream commit 92c77f7c4d5dfaaf45b2ce19360e69977c264766 ] valid_phys_addr_range() is used to sanity check the physical address range of an operation, e.g., access to /dev/mem. It uses __pa(high_memory) internally. If memory is populated at the end of the physical address space, then __pa(high_memory) is outside of the physical address space because: high_memory = (void *)__va(max_pfn * PAGE_SIZE - 1) + 1; For the comparison in valid_phys_addr_range() this is not an issue, but if CONFIG_DEBUG_VIRTUAL is enabled, __pa() maps to __phys_addr(), which verifies that the resulting physical address is within the valid physical address space of the CPU. So in the case that memory is populated at the end of the physical address space, this is not true and triggers a VIRTUAL_BUG_ON(). Use __pa(high_memory - 1) to prevent the conversion from going beyond the end of valid physical addresses. Fixes: be62a3204406 ("x86/mm: Limit mmap() of /dev/mem to valid physical addresses") Signed-off-by: Ralph Campbell Signed-off-by: Thomas Gleixner Cc: Craig Bergstrom Cc: Linus Torvalds Cc: Boris Ostrovsky Cc: Fengguang Wu Cc: Greg Kroah-Hartman Cc: Hans Verkuil Cc: Mauro Carvalho Chehab Cc: Peter Zijlstra Cc: Sander Eikelenboom Cc: Sean Young Link: https://lkml.kernel.org/r/20190326001817.15413-2-rcampbell@nvidia.com Signed-off-by: Sasha Levin (Microsoft) --- arch/x86/mm/mmap.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/arch/x86/mm/mmap.c b/arch/x86/mm/mmap.c index 1e95d57760cf..b69f7d428443 100644 --- a/arch/x86/mm/mmap.c +++ b/arch/x86/mm/mmap.c @@ -230,7 +230,7 @@ bool mmap_address_hint_valid(unsigned long addr, unsigned long len) /* Can we access it for direct reading/writing? Must be RAM: */ int valid_phys_addr_range(phys_addr_t addr, size_t count) { - return addr + count <= __pa(high_memory); + return addr + count - 1 <= __pa(high_memory - 1); } /* Can we access it through mmap? Must be a valid physical address: */ -- 2.19.1