soc: aspeed: lpc-ctrl: Fix boundary check for mmap
authorIwona Winiarska <iwona.winiarska@intel.com>
Tue, 3 Aug 2021 23:48:18 +0000 (01:48 +0200)
committerJoel Stanley <joel@jms.id.au>
Tue, 17 Aug 2021 08:28:42 +0000 (17:58 +0930)
commitb49a0e69a7b1a68c8d3f64097d06dabb770fec96
treefc9c94feb103c6d144676ac7b128428d9b434879
parent2734d6c1b1a089fb593ef6a23d4b70903526fe0c
soc: aspeed: lpc-ctrl: Fix boundary check for mmap

The check mixes pages (vm_pgoff) with bytes (vm_start, vm_end) on one
side of the comparison, and uses resource address (rather than just the
resource size) on the other side of the comparison.
This can allow malicious userspace to easily bypass the boundary check and
map pages that are located outside memory-region reserved by the driver.

Fixes: 6c4e97678501 ("drivers/misc: Add Aspeed LPC control driver")
Cc: stable@vger.kernel.org
Signed-off-by: Iwona Winiarska <iwona.winiarska@intel.com>
Reviewed-by: Andrew Jeffery <andrew@aj.id.au>
Tested-by: Andrew Jeffery <andrew@aj.id.au>
Reviewed-by: Joel Stanley <joel@aj.id.au>
Signed-off-by: Joel Stanley <joel@jms.id.au>
drivers/soc/aspeed/aspeed-lpc-ctrl.c