On Sun, 8 Feb 2015 04:55:12 +0200 Grazvydas Ignotas <notasas@xxxxxxxxx> wrote: > For whatever reason, generic_access_phys() only remaps one page, but > actually allows to access arbitrary size. It's quite easy to trigger > large reads, like printing out large structure with gdb, which leads to > a crash. Fix it by remapping correct size. > > ... > > --- a/mm/memory.c > +++ b/mm/memory.c > @@ -3829,7 +3829,7 @@ int generic_access_phys(struct vm_area_struct *vma, unsigned long addr, > if (follow_phys(vma, addr, write, &prot, &phys_addr)) > return -EINVAL; > > - maddr = ioremap_prot(phys_addr, PAGE_SIZE, prot); > + maddr = ioremap_prot(phys_addr, PAGE_ALIGN(len + offset), prot); > if (write) > memcpy_toio(maddr + offset, buf, len); > else hm, shouldn't this be PAGE_ALIGN(len)? Do we need the PAGE_ALIGN at all? It's probably safer/saner to have it there, but x86 (at least) should be OK with arbitrary alignment on both addr and len? -- To unsubscribe, send a message with 'unsubscribe linux-mm' in the body to majordomo@xxxxxxxxx. For more info on Linux MM, see: http://www.linux-mm.org/ . Don't email: <a href=mailto:"dont@xxxxxxxxx";> email@xxxxxxxxx </a>