powerpc: Fail remap_4k_pfn() if PFN doesn't fit inside PTE

PATCH Superseded Madhusudanan Kandasamy 2 participants 2 messages Jul 10, 2014 PowerPC

Share & tools

Madhusudanan Kandasamy

author

2014-07-10 08:42 UTC #0 lore raw

PATCH v2 1/1 powerpc: Fail remap_4k_pfn() if PFN doesn't fit inside PTE

V2 : Rewritten to avoid helper function as suggested by Stephen Rothwell. remap_4k_pfn() silently truncates upper bits of input 4K PFN if it cannot be contained in PTE. This leads invalid memory mapping and could result in a system crash when the memory is accessed. This patch fails remap_4k_pfn() and returns -EINVAL if the input 4K PFN cannot be contained in PTE.

Signed-off-by Madhusudanan Kandasamy <[email protected]>

---
 arch/powerpc/include/asm/pte-hash64-64k.h | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

arch/powerpc/include/asm/pte-hash64-64k.h +2 -1

index d836d94..b5178e4 100644
@@ -75,7 +75,8 @@
 	(((pte) & _PAGE_COMBO)? MMU_PAGE_4K: MMU_PAGE_64K)
 
 #define remap_4k_pfn(vma, addr, pfn, prot)				\
-	remap_pfn_range((vma), (addr), (pfn), PAGE_SIZE,		\
+	WARN_ON((pfn >= (1UL << (64 - PTE_RPN_SHIFT)))) ? -EINVAL :	\
+		remap_pfn_range((vma), (addr), (pfn), PAGE_SIZE,	\
 			__pgprot(pgprot_val((prot)) | _PAGE_4K_PFN))
 
 #endif	/* __ASSEMBLY__ */

Signature · 1 line

2.0.1

Brian W Hart

2014-07-10 13:59 UTC #1 lore raw

Quoted 28 lines · Madhusudanan Kandasamy

V2 : Rewritten to avoid helper function as suggested by Stephen Rothwell. remap_4k_pfn() silently truncates upper bits of input 4K PFN if it cannot be contained in PTE. This leads invalid memory mapping and could result in a system crash when the memory is accessed. This patch fails remap_4k_pfn() and returns -EINVAL if the input 4K PFN cannot be contained in PTE.
Signed-off-by Madhusudanan Kandasamy <[email protected]>
---
 arch/powerpc/include/asm/pte-hash64-64k.h | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)
arch/powerpc/include/asm/pte-hash64-64k.h +2 -1
index d836d94..b5178e4 100644
@@ -75,7 +75,8 @@
 	(((pte) & _PAGE_COMBO)? MMU_PAGE_4K: MMU_PAGE_64K)
 
 #define remap_4k_pfn(vma, addr, pfn, prot)				\
-	remap_pfn_range((vma), (addr), (pfn), PAGE_SIZE,		\
+	WARN_ON((pfn >= (1UL << (64 - PTE_RPN_SHIFT)))) ? -EINVAL :	\
+		remap_pfn_range((vma), (addr), (pfn), PAGE_SIZE,	\
 			__pgprot(pgprot_val((prot)) | _PAGE_4K_PFN))
 
 #endif	/* __ASSEMBLY__ */
Signature · 1 line
2.0.1

Chatted with Madhu. He'll send a new version that adds some parentheses to protect 'pfn' inside the macro and the entire macro against use cases like:

    !remap_4k_pfn(...)

brian