From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-yx1-f53.google.com (mail-yx1-f53.google.com [74.125.224.53]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 6167737649D for ; Thu, 25 Jun 2026 08:58:29 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=74.125.224.53 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1782377910; cv=none; b=p62/VIzTvB7CzQ6Rz9ino66kHgdsl+Ob3RsB3X6+URsaAAeE4f4MeKk7n1df77McbYXQ6vJpDAQVSjvU3QonOPoMpdVZ1n1lIF893NQnbblwVTQaFxjeY6vfXnkBEjqUwlGwcdREfH3VZVs6oXSzHd8aYfPyvHvP1ga9P0hgtfs= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1782377910; c=relaxed/simple; bh=mBx1RaNjuhhIOlyB6e4Fz3aKuQmS7WVwxij3N6JFznw=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version; b=da5r13AQsi/cyGxxPouJ7MJqaGdgjtQBmUym8Tnf6dnEYKSbut4eZ0q22K6iQOEhR7YSR7HsdZ2ZyypxnDoKvJ/jZclUsHED43MChEoZJ70nfryyTOCWhqzjwCpFPEwAALnF9SUf6oZQKJ5+93j6zI2gBsgjF7aH/TetdmZOfGs= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=SXVZAo8q; arc=none smtp.client-ip=74.125.224.53 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="SXVZAo8q" Received: by mail-yx1-f53.google.com with SMTP id 956f58d0204a3-662dd616cdbso2009328d50.1 for ; Thu, 25 Jun 2026 01:58:29 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1782377908; x=1782982708; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:from:to:cc:subject:date:message-id:reply-to; bh=WHMuCKDp3YbDDMvuKoLEQaGreX8W6rFv5szF7QtOh38=; b=SXVZAo8qXAU5qukc04UndnMQpvkqja0QpLbranfS4wvWKnmkHUEA68zk6WjxQ1fLuE oUvqRadvqqL6SBU+MSzYlVOkqLsbSvQGDc96Ati12Y5G28oCOiwzRQHu4sOMpkSbf7CA guAQ4jxTL8sx7PAmfWdZlI7as4c5uvf47oSuruRlmg2LcjajXd1GDwA3az2oK4Puf1rt LlDDV4261h59UE0WOGbR5X/i/NPxuZmozuV9925DoEUOrlOhKym27EBJeDS7lVJkOMBm MIa7oysKvveJ+4vTZTdYiJRxaDAbJQN+screBscuJXDhCkRM/030h6n6UAlSeKaWVi/i OmTQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1782377908; x=1782982708; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:x-gm-gg:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to; bh=WHMuCKDp3YbDDMvuKoLEQaGreX8W6rFv5szF7QtOh38=; b=bDl6RB/oTBQF8jlUSApHNV1mT5FYPFD8J6c5TZ/mFXkr6zH+GUROSk2vfqhKpaKH1K Q7e8c1UiBNHH5a4/xaOqEq19v18xUk1KO0K6pqAd6KRK42k2VhASy8xn7yAJ9pk47FTL 8jZpwugftLKFMTRflPIE6osN4cTrhf0pQ4PxJG2xUNUDLfhhdPV7f9gpmBJrT8FwqNgh 3lq/p6IhRqMjXXFtPPp2iF9bDn1AXbbqzsC/tW/Gj1CzmZvO+IJG04u5H1OHzpBsUTpu +KvyEYCYGLZnr5FxiQYBkqgrI8QFzt4HSvoALPeI5UDY3Ka6q0jVXhcpOgedPzbKTNBd lIAw== X-Forwarded-Encrypted: i=1; AHgh+RqOUcc6l5oDPimKKw5dd6rqs4PjdlywNJkDgc4DLLKl7XYJQOzsLHsjwt+tWB9QY2O/dDkaGWfqo0fzTek=@vger.kernel.org X-Gm-Message-State: AOJu0Ywh5sG26tLwfeCT43ugupDGZFk+5IMMJbvkxS6FTqJWVfQLa5CN gKFLFv7U66qO5eC+Uf39w+qVeyVEn0elFIQV0yx8OvXNtNVwOm6xPPcrw+QiTWCxmhDibw== X-Gm-Gg: AfdE7ckkazxdL+tOkaA0vzncyWycYqwF486vdMQh2LTt0JtQ91PgwjyELOr9Es3akRy 4ccMDu5vYgsw7mysDi+pX1CtZD0BwhygZoIURvE6VZq5mjCl7/K5hKjNQl6QoMhMHOdYK8hZ/R+ k1NeAsc1Vv9c0HgIvQVJgdTzzcKCcIrl3M7KEEiivaUE0AXuGbqe1vlG1rwOW88QoWK0gjzupG2 5cDhiYLA7hKPm3N3UoLtciAnez6sWzxsd9csLwuvh+sQJYifgLhBGv/ijG4L+kz5b48LrhJxoLQ dRtYp+AsiRNFBeF8KNjgTIGqZuMWS5B9Fxnn2ZaXVGH75CNSixpMTO0+ci76GU8HqPZ60WG5X4J aV8KOizge4GUZ1cvce0Tl7x57pUnuCD9spu8B0JYUtIDFFgsUqPlSsB/lHZdBwpXAayPV6+ewJI 4GbypDtj8P8xfURZsZ55QRxXEDwQ== X-Received: by 2002:a05:690e:168b:b0:662:a4ee:104b with SMTP id 956f58d0204a3-664882bb9bdmr1048451d50.48.1782377908381; Thu, 25 Jun 2026 01:58:28 -0700 (PDT) Received: from Dev-Null-MSI ([2a0d:3344:52ac:a808:98a4:4381:be45:536f]) by smtp.gmail.com with ESMTPSA id 956f58d0204a3-6647f917b1csm1059566d50.13.2026.06.25.01.58.25 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Thu, 25 Jun 2026 01:58:27 -0700 (PDT) From: Yousef Alhouseen To: Arnd Bergmann , Greg Kroah-Hartman Cc: Russell King , Yoshinori Sato , Rich Felker , John Paul Adrian Glaubitz , linux-kernel@vger.kernel.org, linux-arm-kernel@lists.infradead.org, linux-sh@vger.kernel.org, Yousef Alhouseen Subject: [PATCH] char: mem: keep arch range checks overflow-safe Date: Thu, 25 Jun 2026 10:58:00 +0200 Message-ID: <20260625085800.4505-1-alhouseenyousef@gmail.com> X-Mailer: git-send-email 2.54.0 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit The generic /dev/mem physical range check now avoids validating addr + size directly, but ARM and SH provide their own valid_phys_addr_range() implementations with the same wrapped-addition pattern. Use subtraction-based upper-bound checks in those overrides as well. Also make the ARM mmap pfn check avoid overflowing the pfn plus page-count expression. Suggested-by: Arnd Bergmann Signed-off-by: Yousef Alhouseen --- arch/arm/mm/mmap.c | 9 +++++++-- arch/sh/mm/mmap.c | 4 +++- 2 files changed, 10 insertions(+), 3 deletions(-) diff --git a/arch/arm/mm/mmap.c b/arch/arm/mm/mmap.c index 3dbb383c2..7467ce8cd 100644 --- a/arch/arm/mm/mmap.c +++ b/arch/arm/mm/mmap.c @@ -150,9 +150,11 @@ arch_get_unmapped_area_topdown(struct file *filp, const unsigned long addr0, */ int valid_phys_addr_range(phys_addr_t addr, size_t size) { + phys_addr_t end = __pa(high_memory - 1) + 1; + if (addr < PHYS_OFFSET) return 0; - if (addr + size > __pa(high_memory - 1) + 1) + if (addr > end || size > end - addr) return 0; return 1; @@ -163,5 +165,8 @@ int valid_phys_addr_range(phys_addr_t addr, size_t size) */ int valid_mmap_phys_addr_range(unsigned long pfn, size_t size) { - return (pfn + (size >> PAGE_SHIFT)) <= (1 + (PHYS_MASK >> PAGE_SHIFT)); + unsigned long max_pfn = 1 + (PHYS_MASK >> PAGE_SHIFT); + unsigned long pages = size >> PAGE_SHIFT; + + return pfn <= max_pfn && pages <= max_pfn - pfn; } diff --git a/arch/sh/mm/mmap.c b/arch/sh/mm/mmap.c index c442734d9..ba7aade46 100644 --- a/arch/sh/mm/mmap.c +++ b/arch/sh/mm/mmap.c @@ -170,9 +170,11 @@ arch_get_unmapped_area_topdown(struct file *filp, const unsigned long addr0, */ int valid_phys_addr_range(phys_addr_t addr, size_t count) { + phys_addr_t end = __pa(high_memory); + if (addr < __MEMORY_START) return 0; - if (addr + count > __pa(high_memory)) + if (addr > end || count > end - addr) return 0; return 1; -- 2.54.0