Now we have range_in_vma_desc(), update remap_pfn_range_prepare() to check whether the input range in contained within the specified VMA, so we can fail at prepare time if an invalid range is specified.
This covers the I/O remap mmap actions also which ultimately call into this function, and other mmap action types either already span the full VMA or check this already. Reviewed-by: Suren Baghdasaryan <[email protected]> Signed-off-by: Lorenzo Stoakes (Oracle) <[email protected]> --- mm/memory.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/mm/memory.c b/mm/memory.c index 53ef8ef3d04a..68cc592ff0ba 100644 --- a/mm/memory.c +++ b/mm/memory.c @@ -3142,6 +3142,9 @@ int remap_pfn_range_prepare(struct vm_area_desc *desc) const bool is_cow = vma_desc_is_cow_mapping(desc); int err; + if (!range_in_vma_desc(desc, start, end)) + return -EFAULT; + err = get_remap_pgoff(is_cow, start, end, desc->start, desc->end, pfn, &desc->pgoff); if (err) -- 2.53.0
