AcoSail/kernel_optimize_test
8
0
Fork 0
forked from luck/tmp_suning_uos_patched
Code Pull Requests Activity

memremap: check pfn validity before passing to pfn_to_page()

Browse Source 
In memremap's helper function try_ram_remap(), we dereference a struct
page pointer that was derived from a PFN that is known to be covered by
a 'System RAM' iomem region, and is thus assumed to be a 'valid' PFN,
i.e., a PFN that has a struct page associated with it and is covered by
the kernel direct mapping.

However, the assumption that there is a 1:1 relation between the System
RAM iomem region and the kernel direct mapping is not universally valid
on all architectures, and on ARM and arm64, 'System RAM' may include
regions for which pfn_valid() returns false.

Generally speaking, both __va() and pfn_to_page() should only ever be
called on PFNs/physical addresses for which pfn_valid() returns true, so
add that check to try_ram_remap().

Signed-off-by: Ard Biesheuvel <ard.biesheuvel@linaro.org>
Cc: Dan Williams <dan.j.williams@intel.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
This commit is contained in:
Ard Biesheuvel 2016-03-09 14:08:32 -08:00 committed by Linus Torvalds
parent 0a2e280b6d
commit ac343e882a
1 changed files with 2 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
kernel/memremap.c
View File

@ -29,10 +29,10 @@ __weak void __iomem *ioremap_cache(resource_size_t offset, unsigned long size)
static void *try_ram_remap(resource_size_t offset, size_t size) static void *try_ram_remap(resource_size_t offset, size_t size)
{ {
struct page *page = pfn_to_page(offset >> PAGE_SHIFT); unsigned long pfn = PHYS_PFN(offset);
/* In the simple case just return the existing linear address */ /* In the simple case just return the existing linear address */
if (!PageHighMem(page)) if (pfn_valid(pfn) && !PageHighMem(pfn_to_page(pfn)))
return __va(offset); return __va(offset);
return NULL; /* fallback to ioremap_cache */ return NULL; /* fallback to ioremap_cache */
} }