Commit 6da2d377 authored by Ian Abbott's avatar Ian Abbott Committed by Greg Kroah-Hartman

UIO: Take offset into account when determining number of pages that can be mapped

If a UIO memory region does not start on a page boundary but straddles one,
the number of actual pages that overlap the memory region may be calculated
incorrectly because the offset isn't taken into account.  If userspace sets
the mmap length to offset+size, it may fail with -EINVAL if UIO thinks it's
trying to allocate too many pages.
Signed-off-by: default avatarIan Abbott <abbotti@mev.co.uk>
Cc: Hans J. Koch <hjk@linutronix.de>
Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@suse.de>
parent 1bafeb37
...@@ -708,7 +708,8 @@ static int uio_mmap(struct file *filep, struct vm_area_struct *vma) ...@@ -708,7 +708,8 @@ static int uio_mmap(struct file *filep, struct vm_area_struct *vma)
return -EINVAL; return -EINVAL;
requested_pages = (vma->vm_end - vma->vm_start) >> PAGE_SHIFT; requested_pages = (vma->vm_end - vma->vm_start) >> PAGE_SHIFT;
actual_pages = (idev->info->mem[mi].size + PAGE_SIZE -1) >> PAGE_SHIFT; actual_pages = ((idev->info->mem[mi].addr & ~PAGE_MASK)
+ idev->info->mem[mi].size + PAGE_SIZE -1) >> PAGE_SHIFT;
if (requested_pages > actual_pages) if (requested_pages > actual_pages)
return -EINVAL; return -EINVAL;
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment