lists  /  announce  owl-users  owl-dev  john-users  john-dev  passwdqc-users  yescrypt  popa3d-users  /  oss-security  kernel-hardening  musl  sabotage  tlsify  passwords  /  crypt-dev  xvendor  /  Bugtraq  Full-Disclosure  linux-kernel  linux-netdev  linux-ext4  linux-hardening  PHC 
Open Source and information security mailing list archives
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [<thread-prev] [day] [month] [year] [list]
Date:	Thu, 20 Mar 2014 17:24:54 +0900
From:	Nobuhiro Iwamatsu <>
To:	Greg KH <>
CC:	<>
Subject: Re: [PATCH] uio: Fix memory size check with vma in uio_mmap_physical()

(2014/03/18 8:26), Greg KH wrote:
> On Wed, Mar 12, 2014 at 10:24:21AM +0900, Nobuhiro Iwamatsu wrote:
>> Register for the device are mapped in uio_mmap_physical().
>> In this case, it might not be the same as the size of VMA always.
> Why wouldn't this be the case?

size contained in the "mem-> size" is the size of the actual always.
However, in this case, "if (vma-> vm_end - vma-> vm_start> mem-> size)" is an error by always.
This is because the address contained in the vma is because it is always aligned by PAGE_SIZE.

>> This uses PAGE_ALIGN to memory size, fix the check of the memory size
>> to be mapped.
>> Signed-off-by: Nobuhiro Iwamatsu<>
>> ---
>>   drivers/uio/uio.c | 2 +-
>>   1 file changed, 1 insertion(+), 1 deletion(-)
>> diff --git a/drivers/uio/uio.c b/drivers/uio/uio.c
>> index a673e5b..e371f5a 100644
>> --- a/drivers/uio/uio.c
>> +++ b/drivers/uio/uio.c
>> @@ -655,7 +655,7 @@ static int uio_mmap_physical(struct vm_area_struct *vma)
>>   	if (mem->addr&  ~PAGE_MASK)
>>   		return -ENODEV;
>> -	if (vma->vm_end - vma->vm_start>  mem->size)
>> +	if (vma->vm_end - vma->vm_start>  PAGE_ALIGN(mem->size))
> You just increased the size for the check, that seems wrong.  Why
> wouldn't mem->size be correct here?
> What hardware is failing for this with a valid size and end/start
> addresses?

For example, when I have the following settings in in platform device setup,
the size of the mem->size will be 344.

static struct resource vpu_resources[] = {
	[0] = {
		.name	= "VPU",
		.start	= 0xfe900000,
		.end	= 0xfe900157,
		.flags	= IORESOURCE_MEM,

And vma->vm_start was set 0xB6F9F000, vma->start was set B6FA0000.
Therefore, this is "if (vma-> vm_end - vma-> vm_start> mem-> size)" will result in an error.
Am I wrong how to use UIO?

> thanks,
> greg k-h

Best regards,
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to
More majordomo info at
Please read the FAQ at

Powered by blists - more mailing lists