[PATCH 2/3] s390/vmem: fix possible memory overwrite

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



If for whatever reason the sub-PMD region to be used is less
than struct page size (e.g in the future), then it is possible
to overwrite beyond the region size.

Signed-off-by: Alexander Gordeev <agordeev@xxxxxxxxxxxxx>
---
 arch/s390/mm/vmem.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/arch/s390/mm/vmem.c b/arch/s390/mm/vmem.c
index 56ab9bb770f3a..d7f25884061f4 100644
--- a/arch/s390/mm/vmem.c
+++ b/arch/s390/mm/vmem.c
@@ -91,13 +91,15 @@ static void vmemmap_flush_unused_pmd(void)
 
 static void __vmemmap_use_sub_pmd(unsigned long start, unsigned long end)
 {
+	unsigned long size = min(end - start, sizeof(struct page));
+
 	/*
 	 * As we expect to add in the same granularity as we remove, it's
 	 * sufficient to mark only some piece used to block the memmap page from
 	 * getting removed (just in case the memmap never gets initialized,
 	 * e.g., because the memory block never gets onlined).
 	 */
-	memset(__va(start), 0, sizeof(struct page));
+	memset(__va(start), 0, size);
 }
 
 static void vmemmap_use_sub_pmd(unsigned long start, unsigned long end)
-- 
2.26.0




[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[Index of Archives]     [Kernel Development]     [Kernel Newbies]     [IDE]     [Security]     [Git]     [Netfilter]     [Bugtraq]     [Yosemite Info]     [MIPS Linux]     [ARM Linux]     [Linux Security]     [Linux RAID]     [Linux ATA RAID]     [Samba]     [Linux Media]     [Device Mapper]

  Powered by Linux