diff options
| author | Gerd Hoffmann <kraxel@redhat.com> | 2022-06-20 10:15:47 +0300 |
|---|---|---|
| committer | Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 2022-06-29 10:04:32 +0300 |
| commit | 44bb0618ae37c8a05b93acfcd044b9beb42201dd (patch) | |
| tree | 70d9faf74695592746f53a774519ee33e174a877 /drivers/dma-buf | |
| parent | 9b95ee8990d9b4b6086c309632b9d0d576833abe (diff) | |
| download | linux-44bb0618ae37c8a05b93acfcd044b9beb42201dd.tar.xz | |
udmabuf: add back sanity check
[ Upstream commit 05b252cccb2e5c3f56119d25de684b4f810ba40a ]
Check vm_fault->pgoff before using it. When we removed the warning, we
also removed the check.
Fixes: 7b26e4e2119d ("udmabuf: drop WARN_ON() check.")
Reported-by: zdi-disclosures@trendmicro.com
Suggested-by: Linus Torvalds <torvalds@linuxfoundation.org>
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
Diffstat (limited to 'drivers/dma-buf')
| -rw-r--r-- | drivers/dma-buf/udmabuf.c | 5 |
1 files changed, 4 insertions, 1 deletions
diff --git a/drivers/dma-buf/udmabuf.c b/drivers/dma-buf/udmabuf.c index e7330684d3b8..9631f2fd2faf 100644 --- a/drivers/dma-buf/udmabuf.c +++ b/drivers/dma-buf/udmabuf.c @@ -32,8 +32,11 @@ static vm_fault_t udmabuf_vm_fault(struct vm_fault *vmf) { struct vm_area_struct *vma = vmf->vma; struct udmabuf *ubuf = vma->vm_private_data; + pgoff_t pgoff = vmf->pgoff; - vmf->page = ubuf->pages[vmf->pgoff]; + if (pgoff >= ubuf->pagecount) + return VM_FAULT_SIGBUS; + vmf->page = ubuf->pages[pgoff]; get_page(vmf->page); return 0; } |