commit b49a0e69a7b1a68c8d3f64097d06dabb770fec96 upstream.
The check mixes pages (vm_pgoff) with bytes (vm_start, vm_end) on one
side of the comparison, and uses resource address (rather than just the
resource size) on the other side of the comparison.
This can allow malicious userspace to easily bypass the boundary check and
map pages that are located outside memory-region reserved by the driver.
Fixes: 6c4e976785 ("drivers/misc: Add Aspeed LPC control driver")
Cc: stable@vger.kernel.org
Signed-off-by: Iwona Winiarska <iwona.winiarska@intel.com>
Reviewed-by: Andrew Jeffery <andrew@aj.id.au>
Tested-by: Andrew Jeffery <andrew@aj.id.au>
Reviewed-by: Joel Stanley <joel@aj.id.au>
Signed-off-by: Joel Stanley <joel@jms.id.au>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
ASPEED SoC updates for 5.3
LPC control driver changes and a fix.
* tag 'aspeed-5.3-soc' of git://git.kernel.org/pub/scm/linux/kernel/git/joel/aspeed:
soc: aspeed: lpc-ctrl: Fix probe error handling
soc: aspeed: lpc-ctrl: make parameter optional
Signed-off-by: Olof Johansson <olof@lixom.net>
gcc warns that a mising "flash" phandle node leads to undefined
behavior later:
drivers/soc/aspeed/aspeed-lpc-ctrl.c: In function 'aspeed_lpc_ctrl_probe':
drivers/soc/aspeed/aspeed-lpc-ctrl.c:201:18: error: '*((void *)&resm+8)' may be used uninitialized in this function [-Werror=maybe-uninitialized]
Only set the flash base and size if we find a phandle in the device
tree.
Reported-by: Arnd Bergmann <arnd@arndb.de>
Reviewed-by: Andrew Jeffery <andrew@aj.id.au>
Reviewed-by: Vijay Khemka <vijaykhemka@fb.com>
Signed-off-by: Joel Stanley <joel@jms.id.au>
Making memory-region and flash as optional parameter in device
tree if user needs to use these parameter through ioctl then
need to define in devicetree.
Signed-off-by: Vijay Khemka <vijaykhemka@fb.com>
Reviewed-by: Andrew Jeffery <andrew@aj.id.au>
Signed-off-by: Joel Stanley <joel@jms.id.au>
Based on 1 normalized pattern(s):
this program is free software you can redistribute it and or modify
it under the terms of the gnu general public license as published by
the free software foundation either version 2 of the license or at
your option any later version
extracted by the scancode license scanner the SPDX license identifier
GPL-2.0-or-later
has been chosen to replace the boilerplate/reference in 3029 file(s).
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Reviewed-by: Allison Randal <allison@lohutok.net>
Cc: linux-spdx@vger.kernel.org
Link: https://lkml.kernel.org/r/20190527070032.746973796@linutronix.de
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Create a SoC folder for the ASPEED parts and place the misc drivers
currently present into this folder. These drivers are not generic part
drivers, but rather only apply to the ASPEED SoCs.
Signed-off-by: Patrick Venture <venture@google.com>
Acked-by: Arnd Bergmann <arnd@arndb.de>
Signed-off-by: Olof Johansson <olof@lixom.net>
