From: Heiko Carstens Date: Mon, 22 Oct 2012 13:49:02 +0000 (+0200) Subject: s390/gup: add missing TASK_SIZE check to get_user_pages_fast() X-Git-Url: https://git.stricted.de/?a=commitdiff_plain;h=d55c4c613fc4d4ad2ba0fc6fa2b57176d420f7e4;p=GitHub%2Fexynos8895%2Fandroid_kernel_samsung_universal8895.git s390/gup: add missing TASK_SIZE check to get_user_pages_fast() When walking page tables we need to make sure that everything is within bounds of the ASCE limit of the task's address space. Otherwise we might calculate e.g. a pud pointer which is not within a pud and dereference it. So check against TASK_SIZE (which is the ASCE limit) before walking page tables. Reviewed-by: Gerald Schaefer Cc: stable@vger.kernel.org Signed-off-by: Heiko Carstens Signed-off-by: Martin Schwidefsky --- diff --git a/arch/s390/mm/gup.c b/arch/s390/mm/gup.c index 8b8285310b5a..16fb3c1615dc 100644 --- a/arch/s390/mm/gup.c +++ b/arch/s390/mm/gup.c @@ -229,7 +229,7 @@ int get_user_pages_fast(unsigned long start, int nr_pages, int write, addr = start; len = (unsigned long) nr_pages << PAGE_SHIFT; end = start + len; - if (end < start) + if ((end < start) || (end > TASK_SIZE)) goto slow_irqon; /*