[ARM] 3813/1: prevent >= 4G /dev/mem mmap()

Prevent userland from mapping in physical address regions >= 4G by
checking for that in valid_mmap_phys_addr_range().

Unfortunately, we cannot override valid_mmap_phys_addr_range() without
also overriding valid_phys_addr_range(), so copy drivers/char/mem.c's
version of valid_phys_addr_range() over to arch/arm/mm/mmap.c as well.

Signed-off-by: Lennert Buytenhek <buytenh@wantstofly.org>
Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk>

diff --git a/arch/arm/mm/mmap.c b/arch/arm/mm/mmap.c
index 29e5480..b0b5f46 100644 (file)
--- a/arch/arm/mm/mmap.c
+++ b/arch/arm/mm/mmap.c
@@ -114,3 +114,25 @@ full_search:
        }
 }
 
+
+/*
+ * You really shouldn't be using read() or write() on /dev/mem.  This
+ * might go away in the future.
+ */
+int valid_phys_addr_range(unsigned long addr, size_t size)
+{
+       if (addr + size > __pa(high_memory))
+               return 0;
+
+       return 1;
+}
+
+/*
+ * We don't use supersection mappings for mmap() on /dev/mem, which
+ * means that we can't map the memory area above the 4G barrier into
+ * userspace.
+ */
+int valid_mmap_phys_addr_range(unsigned long pfn, size_t size)
+{
+       return !(pfn + (size >> PAGE_SHIFT) > 0x00100000);
+}

diff --git a/include/asm-arm/io.h b/include/asm-arm/io.h
index bf7b9de..8076a85 100644 (file)
--- a/include/asm-arm/io.h
+++ b/include/asm-arm/io.h
@@ -280,6 +280,10 @@ extern void pci_iounmap(struct pci_dev *dev, void __iomem *addr);
 #define BIOVEC_MERGEABLE(vec1, vec2)   \
        ((bvec_to_phys((vec1)) + (vec1)->bv_len) == bvec_to_phys((vec2)))
 
+#define ARCH_HAS_VALID_PHYS_ADDR_RANGE
+extern int valid_phys_addr_range(unsigned long addr, size_t size);
+extern int valid_mmap_phys_addr_range(unsigned long pfn, size_t size);
+
 /*
  * Convert a physical pointer to a virtual kernel pointer for /dev/mem
  * access