The patch titled mm: don't allow ioremapping of ranges larger than vmalloc space has been removed from the -mm tree. Its filename was mm-dont-allow-ioremapping-of-ranges-larger-than-vmalloc-space.patch This patch was dropped because it was merged into mainline or a subsystem tree The current -mm tree may be found at http://userweb.kernel.org/~akpm/mmotm/ ------------------------------------------------------ Subject: mm: don't allow ioremapping of ranges larger than vmalloc space From: "Robert Bragg" <robert@xxxxxxxxxxxxx> When running with a 16M IOREMAP_MAX_ORDER (on armv7) we found that the vmlist search routine in __get_vm_area_node can mistakenly allow a driver to ioremap a range larger than vmalloc space. If at the time of the ioremap all existing vmlist areas sit below the determined alignment then the search routine continues past all entries and exits the for loop - straight into the found: label - without ever testing for integer wrapping or that the requested size fits. We were seeing a driver successfully ioremap 128M of flash even though there was only 120M of vmalloc space. From that point the system was left with the remainder of the first 16M of space to vmalloc/ioremap within. Signed-off-by: Robert Bragg <robert@xxxxxxxxxxxxx> Acked-by: Nick Piggin <npiggin@xxxxxxx> Signed-off-by: Andrew Morton <akpm@xxxxxxxxxxxxxxxxxxxx> --- mm/vmalloc.c | 4 ++++ 1 file changed, 4 insertions(+) diff -puN mm/vmalloc.c~mm-dont-allow-ioremapping-of-ranges-larger-than-vmalloc-space mm/vmalloc.c --- a/mm/vmalloc.c~mm-dont-allow-ioremapping-of-ranges-larger-than-vmalloc-space +++ a/mm/vmalloc.c @@ -254,6 +254,10 @@ static struct vm_struct *__get_vm_area_n if (addr > end - size) goto out; } + if ((size + addr) < addr) + goto out; + if (addr > end - size) + goto out; found: area->next = *p; _ Patches currently in -mm which might be from robert@xxxxxxxxxxxxx are origin.patch - To unsubscribe from this list: send the line "unsubscribe mm-commits" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html