diff options
| author | Gerd Hoffmann <kraxel@redhat.com> | 2022-06-20 09:15:47 +0200 |
|---|---|---|
| committer | Gerd Hoffmann <kraxel@redhat.com> | 2023-01-06 06:31:01 +0100 |
| commit | 0bb324ec3d27998155ec92f5e196b5912930538e (patch) | |
| tree | 8c439c662773b6b19bcebeed70a1bea66e542488 | |
| parent | 4c00ac500d0edd1a6730c4e8293834a694c1b304 (diff) | |
| download | linux-drm-udmabuf-fix.tar.gz | |
udmabuf: add sanity checkdrm-udmabuf-fix
Check vm_fault->pgoff before using it.
Also set VM_DONTEXPAND for the vma, dma-bufs have a fixed size.
Fixes: 7b26e4e2119d ("udmabuf: drop WARN_ON() check.")
Reported-by: zdi-disclosures@trendmicro.com
Suggested-by: Linus Torvalds <torvalds@linuxfoundation.org>
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
| -rw-r--r-- | drivers/dma-buf/udmabuf.c | 1 |
1 files changed, 1 insertions, 0 deletions
diff --git a/drivers/dma-buf/udmabuf.c b/drivers/dma-buf/udmabuf.c index 740d6e426ee9..37bb179a2b8f 100644 --- a/drivers/dma-buf/udmabuf.c +++ b/drivers/dma-buf/udmabuf.c @@ -58,6 +58,7 @@ static int mmap_udmabuf(struct dma_buf *buf, struct vm_area_struct *vma) return -EINVAL; vma->vm_ops = &udmabuf_vm_ops; + vma->vm_flags |= VM_DONTEXPAND; vma->vm_private_data = ubuf; return 0; } |