From: Alexei Starovoitov <ast@kernel.org> mainline inclusion from mainline-v6.9-rc1 commit 3e49a866c9dcbd8173e4f3e491293619a9e81fa4 category: feature bugzilla: https://gitee.com/openeuler/kernel/issues/I9CHG1 CVE: NA Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?i... ------------------------------------------------- There are various users of get_vm_area() + ioremap_page_range() APIs. Enforce that get_vm_area() was requested as VM_IOREMAP type and range passed to ioremap_page_range() matches created vm_area to avoid accidentally ioremap-ing into wrong address range. Signed-off-by: Alexei Starovoitov <ast@kernel.org> Signed-off-by: Andrii Nakryiko <andrii@kernel.org> Reviewed-by: Christoph Hellwig <hch@lst.de> Link: https://lore.kernel.org/bpf/20240305030516.41519-2-alexei.starovoitov@gmail.... (cherry picked from commit 3e49a866c9dcbd8173e4f3e491293619a9e81fa4) Signed-off-by: Kefeng Wang <wangkefeng.wang@huawei.com> Signed-off-by: ZhangPeng <zhangpeng362@huawei.com> --- mm/vmalloc.c | 13 +++++++++++++ 1 file changed, 13 insertions(+) diff --git a/mm/vmalloc.c b/mm/vmalloc.c index 8210afa4e888..5df166d7426e 100644 --- a/mm/vmalloc.c +++ b/mm/vmalloc.c @@ -307,8 +307,21 @@ static int vmap_range_noflush(unsigned long addr, unsigned long end, int ioremap_page_range(unsigned long addr, unsigned long end, phys_addr_t phys_addr, pgprot_t prot) { + struct vm_struct *area; int err; + area = find_vm_area((void *)addr); + if (!area || !(area->flags & VM_IOREMAP)) { + WARN_ONCE(1, "vm_area at addr %lx is not marked as VM_IOREMAP\n", addr); + return -EINVAL; + } + if (addr != (unsigned long)area->addr || + (void *)end != area->addr + get_vm_area_size(area)) { + WARN_ONCE(1, "ioremap request [%lx,%lx) doesn't match vm_area [%lx, %lx)\n", + addr, end, (long)area->addr, + (long)area->addr + get_vm_area_size(area)); + return -ERANGE; + } err = vmap_range_noflush(addr, end, phys_addr, pgprot_nx(prot), ioremap_max_page_shift); flush_cache_vmap(addr, end); -- 2.25.1