commit 8b07e990fb254fcbaa919616ac77f981cb48c73d upstream.
The check mixes pages (vm_pgoff) with bytes (vm_start, vm_end) on one
side of the comparison, and uses resource address (rather than just the
resource size) on the other side of the comparison.
This can allow malicious userspace to easily bypass the boundary check and
map pages that are located outside memory-region reserved by the driver.
Fixes: 01c60dcea9 ("drivers/misc: Add Aspeed P2A control driver")
Cc: stable@vger.kernel.org
Signed-off-by: Iwona Winiarska <iwona.winiarska@intel.com>
Reviewed-by: Andrew Jeffery <andrew@aj.id.au>
Tested-by: Andrew Jeffery <andrew@aj.id.au>
Reviewed-by: Joel Stanley <joel@aj.id.au>
Signed-off-by: Joel Stanley <joel@jms.id.au>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Pull ARM SoC-related driver updates from Olof Johansson:
"Various driver updates for platforms and a couple of the small driver
subsystems we merge through our tree:
Among the larger pieces:
- Power management improvements for TI am335x and am437x (RTC
suspend/wake)
- Misc new additions for Amlogic (socinfo updates)
- ZynqMP FPGA manager
- Nvidia improvements for reset/powergate handling
- PMIC wrapper for Mediatek MT8516
- Misc fixes/improvements for ARM SCMI, TEE, NXP i.MX SCU drivers"
* tag 'armsoc-drivers' of git://git.kernel.org/pub/scm/linux/kernel/git/soc/soc: (57 commits)
soc: aspeed: fix Kconfig
soc: add aspeed folder and misc drivers
spi: zynqmp: Fix build break
soc: imx: Add generic i.MX8 SoC driver
MAINTAINERS: Update email for Qualcomm SoC maintainer
memory: tegra: Fix a typos for "fdcdwr2" mc client
Revert "ARM: tegra: Restore memory arbitration on resume from LP1 on Tegra30+"
memory: tegra: Replace readl-writel with mc_readl-mc_writel
memory: tegra: Fix integer overflow on tick value calculation
memory: tegra: Fix missed registers values latching
ARM: tegra: cpuidle: Handle tick broadcasting within cpuidle core on Tegra20/30
optee: allow to work without static shared memory
soc/tegra: pmc: Move powergate initialisation to probe
soc/tegra: pmc: Remove reset sysfs entries on error
soc/tegra: pmc: Fix reset sources and levels
soc: amlogic: meson-gx-pwrc-vpu: Add support for G12A
soc: amlogic: meson-gx-pwrc-vpu: Fix power on/off register bitmask
fpga manager: Adding FPGA Manager support for Xilinx zynqmp
dt-bindings: fpga: Add bindings for ZynqMP fpga driver
firmware: xilinx: Add fpga API's
...
