arm64: fixmap: check idx is definitely valid
authorMark Rutland <mark.rutland@arm.com>
Wed, 4 Mar 2015 13:27:35 +0000 (13:27 +0000)
committerWill Deacon <will.deacon@arm.com>
Thu, 19 Mar 2015 10:43:57 +0000 (10:43 +0000)
Fixmap indices are in the interval (FIX_HOLE, __end_of_fixed_addresses),
but in __set_fixmap we only check idx <= __end_of_fixed_addresses, and
therefore indices <= FIX_HOLE are erroneously accepted. If called with
such an idx, __set_fixmap may corrupt page tables outside of the fixmap
region.

This patch ensures that we validate the idx against both endpoints of
the interval.

Cc: Catalin Marinas <catalin.marinas@arm.com>
Cc: Kees Cook <keescook@chromium.org>
Acked-by: Ard Biesheuvel <ard.biesheuvel@linaro.org>
Acked-by: Laura Abbott <lauraa@codeaurora.org>
Signed-off-by: Mark Rutland <mark.rutland@arm.com>
Signed-off-by: Will Deacon <will.deacon@arm.com>
arch/arm64/mm/mmu.c

Simple merge