summaryrefslogtreecommitdiff
path: root/drivers/misc
diff options
context:
space:
mode:
authorIan Munsie <imunsie@au1.ibm.com>2015-07-07 15:45:45 +1000
committerMichael Ellerman <mpe@ellerman.id.au>2015-07-08 15:17:47 +1000
commit10a5894f2dedd8a26b3132497445b314c0d952c4 (patch)
treeacd7285af4b5dfa807aac35aee9ed1f648c7475b /drivers/misc
parent5caaf5346892d1e7f0b8b7223062644f8538483f (diff)
cxl: Fix off by one error allowing subsequent mmap page to be accessed
It was discovered that if a process mmaped their problem state area they were able to access one page more than expected, potentially allowing them to access the problem state area of an unrelated process. This was due to a simple off by one error in the mmap fault handler introduced in 0712dc7e73e59d79bcead5d5520acf4e9e917e87 ("cxl: Fix issues when unmapping contexts"), which is fixed in this patch. Cc: stable@vger.kernel.org Fixes: 0712dc7e73e5 ("cxl: Fix issues when unmapping contexts") Signed-off-by: Ian Munsie <imunsie@au1.ibm.com> Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
Diffstat (limited to 'drivers/misc')
-rw-r--r--drivers/misc/cxl/context.c4
1 files changed, 2 insertions, 2 deletions
diff --git a/drivers/misc/cxl/context.c b/drivers/misc/cxl/context.c
index 6236d4a1f7ad..1287148629c0 100644
--- a/drivers/misc/cxl/context.c
+++ b/drivers/misc/cxl/context.c
@@ -113,11 +113,11 @@ static int cxl_mmap_fault(struct vm_area_struct *vma, struct vm_fault *vmf)
if (ctx->afu->current_mode == CXL_MODE_DEDICATED) {
area = ctx->afu->psn_phys;
- if (offset > ctx->afu->adapter->ps_size)
+ if (offset >= ctx->afu->adapter->ps_size)
return VM_FAULT_SIGBUS;
} else {
area = ctx->psn_phys;
- if (offset > ctx->psn_size)
+ if (offset >= ctx->psn_size)
return VM_FAULT_SIGBUS;
}