diff options
| author | Gerd Hoffmann | 2022-06-20 09:15:47 +0200 |
|---|---|---|
| committer | Linus Torvalds | 2022-06-20 08:38:29 -0500 |
| commit | 05b252cccb2e5c3f56119d25de684b4f810ba40a (patch) | |
| tree | 3440116ce35993ffedcfa6067503574208e77062 | |
| parent | a111daf0c53ae91e71fd2bfe7497862d14132e3e (diff) | |
udmabuf: add back sanity check
Check vm_fault->pgoff before using it. When we removed the warning, we
also removed the check.
Fixes: 7b26e4e2119d ("udmabuf: drop WARN_ON() check.")
Reported-by: zdi-disclosures@trendmicro.com
Suggested-by: Linus Torvalds <torvalds@linuxfoundation.org>
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
| -rw-r--r-- | drivers/dma-buf/udmabuf.c | 5 |
1 files changed, 4 insertions, 1 deletions
diff --git a/drivers/dma-buf/udmabuf.c b/drivers/dma-buf/udmabuf.c index e7330684d3b8..9631f2fd2faf 100644 --- a/drivers/dma-buf/udmabuf.c +++ b/drivers/dma-buf/udmabuf.c @@ -32,8 +32,11 @@ static vm_fault_t udmabuf_vm_fault(struct vm_fault *vmf) { struct vm_area_struct *vma = vmf->vma; struct udmabuf *ubuf = vma->vm_private_data; + pgoff_t pgoff = vmf->pgoff; - vmf->page = ubuf->pages[vmf->pgoff]; + if (pgoff >= ubuf->pagecount) + return VM_FAULT_SIGBUS; + vmf->page = ubuf->pages[pgoff]; get_page(vmf->page); return 0; } |