soc: aspeed: p2a-ctrl: Fix boundary check for mmap
authorIwona Winiarska <iwona.winiarska@intel.com>
Tue, 3 Aug 2021 23:48:19 +0000 (01:48 +0200)
committerJoel Stanley <joel@jms.id.au>
Tue, 17 Aug 2021 08:30:44 +0000 (18:00 +0930)
commit8b07e990fb254fcbaa919616ac77f981cb48c73d
treed293d1a79b058fdd9e62887a0ca9a146077aa9ba
parentb49a0e69a7b1a68c8d3f64097d06dabb770fec96
soc: aspeed: p2a-ctrl: Fix boundary check for mmap

The check mixes pages (vm_pgoff) with bytes (vm_start, vm_end) on one
side of the comparison, and uses resource address (rather than just the
resource size) on the other side of the comparison.
This can allow malicious userspace to easily bypass the boundary check and
map pages that are located outside memory-region reserved by the driver.

Fixes: 01c60dcea9f7 ("drivers/misc: Add Aspeed P2A control driver")
Cc: stable@vger.kernel.org
Signed-off-by: Iwona Winiarska <iwona.winiarska@intel.com>
Reviewed-by: Andrew Jeffery <andrew@aj.id.au>
Tested-by: Andrew Jeffery <andrew@aj.id.au>
Reviewed-by: Joel Stanley <joel@aj.id.au>
Signed-off-by: Joel Stanley <joel@jms.id.au>
drivers/soc/aspeed/aspeed-p2a-ctrl.c