Commit:     5dc331852848a38ca00a2817e5b98a1d0561b116
Parent:     a7f75e25860ac0a7b70cf6e14c37618d2d2bb890
Author:     Robert Bragg <[EMAIL PROTECTED]>
AuthorDate: Mon Feb 4 22:29:18 2008 -0800
Committer:  Linus Torvalds <[EMAIL PROTECTED]>
CommitDate: Tue Feb 5 09:44:18 2008 -0800

    mm: don't allow ioremapping of ranges larger than vmalloc space
    When running with a 16M IOREMAP_MAX_ORDER (on armv7) we found that the
    vmlist search routine in __get_vm_area_node can mistakenly allow a driver
    to ioremap a range larger than vmalloc space.
    If at the time of the ioremap all existing vmlist areas sit below the
    determined alignment then the search routine continues past all entries and
    exits the for loop - straight into the found: label - without ever testing
    for integer wrapping or that the requested size fits.
    We were seeing a driver successfully ioremap 128M of flash even though
    there was only 120M of vmalloc space.  From that point the system was left
    with the remainder of the first 16M of space to vmalloc/ioremap within.
    Signed-off-by: Robert Bragg <[EMAIL PROTECTED]>
    Acked-by: Nick Piggin <[EMAIL PROTECTED]>
    Signed-off-by: Andrew Morton <[EMAIL PROTECTED]>
    Signed-off-by: Linus Torvalds <[EMAIL PROTECTED]>
 mm/vmalloc.c |    4 ++++
 1 files changed, 4 insertions(+), 0 deletions(-)

diff --git a/mm/vmalloc.c b/mm/vmalloc.c
index 4efc41a..0536dde 100644
--- a/mm/vmalloc.c
+++ b/mm/vmalloc.c
@@ -254,6 +254,10 @@ static struct vm_struct *__get_vm_area_node(unsigned long 
size, unsigned long fl
                if (addr > end - size)
                        goto out;
+       if ((size + addr) < addr)
+               goto out;
+       if (addr > end - size)
+               goto out;
        area->next = *p;
To unsubscribe from this list: send the line "unsubscribe git-commits-head" in
the body of a message to [EMAIL PROTECTED]
More majordomo info at

Reply via email to