From mboxrd@z Thu Jan 1 00:00:00 1970 Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.remote-ip=100.103.45.18 ARC-Seal: i=1; d=subspace.kernel.org; s=arc20261015; a=rsa-sha256; cv=none; t=1794591468; b=Wb1esptewaTYcgeAxzkT/heqsGcfJSM/I4mfqenPxPMmAi9d9WSjTsVoj4RTEo6nw7SF jyMAsFkb3iIdxuvFkb+OOiV9+y7lTCQXFJDKI05WBczODbdBf2PSCrB0feWnDxnSLexbJ GswDzJuDdLBE67h6bmhcXyHkIu60bqyaazxPW5fleyTO7XKnf4QhcYP7gbS56NwUH7Iec QImMnO09RAkyX8jL07/RwAkVjptLyk9k/2jGwAO3E+EXDjUWvSb/p11LXoo0qZH0ik6Gs rxhLdCDVcEgw9NZ+FzjOIf8G680QiXRQQEM5U6036lhGvIxCxFlzWajo0tUMESnHfoA== ARC-Message-Signature: i=1; d=subspace.kernel.org; s=arc20261015; a=rsa-sha256; c=relaxed/relaxed; t=1794591468; h=Received:DKIM-Signature:From:To:Cc:Subject:Date:Message-ID:X-Mailer: In-Reply-To:References:User-Agent:X-stable:X-Patchwork-Hint: MIME-Version:Content-Transfer-Encoding; bh=zEGExgT52X3ebdfQ10mT2Yy4b+w3quRNUvoOL5EBsFE=; b=eyARyybqpV97juV5TB18xEXTFoP4mltvpqjzRfv5GQmkzhCrjkEy1Z25R7QpjpiHLccI gd0PHo0K9XG0/83MsXshpVZNgI26ZOzho6mYFtXAw9EsPKT8666cJ7Ev0XEk/F/pSTP2n 4rG/YyZR+8krnvAs48HeXkJh/Jx6F+BnaUgOyINuQRjycrxypqkY2av0uFLy7GTcBGih5 ToV3dePQfLLvOmaP1Fap76Kqi6k5868vj/a0MDmiSVgBoSrfKzYXU+kXn2LZjFrCkomcL fke8D3CN35nvvnU+SqWPHetqAbprJU3y/gp2uOGPur1myuXE6C4aOlqnRceXNPVZP+g== ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dkim=pass header.d=linuxfoundation.org header.i=@linuxfoundation.org header.a=rsa-sha256 header.s=korg header.b=CCtjz3Vy; arc=none smtp.remote-ip=100.103.45.18 Received: from smtp.kernel.org (quasi.space.kernel.org [100.103.45.18]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature ECDSA (prime256v1)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 6631F607D2C3; Fri, 13 Nov 2026 17:37:48 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.a=rsa-sha256 header.s=korg header.b=CCtjz3Vy Received: by smtp.kernel.org (Postfix) with ESMTPSA id 181F91F000C4; Fri, 13 Nov 2026 17:37:48 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linuxfoundation.org; s=korg; t=1794591468; bh=zEGExgT52X3ebdfQ10mT2Yy4b+w3quRNUvoOL5EBsFE=; h=From:To:Cc:Subject:Date:In-Reply-To:References; b=CCtjz3VyvuznD5ZeJJFv8lXidv0duMpWtcSgFzDlUrHo+dJR/igJVIlYUww97YcJZ c4r/KQsvjX3O+5fvoXbhIFZ5p/Dorp1qYJxB2ScjgY6SbUe4iJwCbimYSFbKCHbK2H AXkcy3vUOYf6IGBhb6BN6WyF8Ig+MHJxBH/ZpiNg= From: Greg Kroah-Hartman To: stable@vger.kernel.org Cc: Greg Kroah-Hartman , patches@lists.linux.dev, Luxiao Xu , Ren Wei , Andrew Morton , Vega , David Hildenbrand , Grazvydas Ignotas , "Liam R. Howlett" , Lorenzo Stoakes , Michal Hocko , Mike Rapoport , Suren Baghdasaryan , Vlastimil Babka , Sasha Levin Subject: [PATCH 6.12 552/670] mm/memory: constrain generic_access_phys() to page boundary Date: Fri, 13 Nov 2026 10:51:56 -0500 Message-ID: <20261113153830.586955050@linuxfoundation.org> X-Mailer: git-send-email 2.56.0 In-Reply-To: <20261113153811.177190860@linuxfoundation.org> References: <20261113153811.177190860@linuxfoundation.org> User-Agent: quilt/0.69 X-stable: review X-Patchwork-Hint: ignore X-Mailing-List: patches@lists.linux.dev List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Transfer-Encoding: 8bit 6.12-stable review patch. If anyone has any objections, please let me know. ------------------ From: Luxiao Xu [ Upstream commit ae0298a5fbeff32951c0d31398ccec97ec6aa0ea ] This patch addresses an issue in generic_access_phys() where accessing memory across page boundaries in PFNMAP VMAs assumes physical pages are contiguous, which can lead to accessing unintended physical memory or exceeding VMA boundaries. generic_access_phys() improperly validates the memory access range: it only validates the start address using follow_pfnmap_start() and passes PAGE_ALIGN(len + offset) to ioremap_prot(). This poses two problems: 1. In PFNMAP VMAs, consecutive virtual pages are not guaranteed to be physically contiguous, and individual PTEs may have different access permissions or writability. 2. The mapping may cross VMA boundaries if len extends beyond vma->vm_end. Constrain the access in generic_access_phys() to at most the current page boundary (PAGE_SIZE - offset) and map only a single PAGE_SIZE via ioremap_prot(). Since the caller __access_remote_vm() already loops over the requested length and handles partial transfers, it will naturally iterate over the remaining pages. Also add a missing (resource_size_t) cast during PFN re-validation to avoid truncation on 32-bit PAE systems. Link: https://lore.kernel.org/e06e28a46c2a176238f03b5740df0913e57c2861.1788842306.git.rakukuip@gmail.com Fixes: 9cb12d7b4cca ("mm/memory.c: actually remap enough memory") Signed-off-by: Luxiao Xu Signed-off-by: Ren Wei Signed-off-by: Andrew Morton Reported-by: Vega Suggested-by: David Hildenbrand Acked-by: David Hildenbrand (Arm) Assisted-by: LLM Cc: Grazvydas Ignotas Cc: Liam R. Howlett Cc: Lorenzo Stoakes Cc: Michal Hocko Cc: Mike Rapoport Cc: Suren Baghdasaryan Cc: Vlastimil Babka Cc: [ sashal: Adjusted context to retain prot != pgprot_val(args.pgprot) for the unsigned long protection API. ] Signed-off-by: Sasha Levin --- mm/memory.c | 10 ++++++++-- 1 file changed, 8 insertions(+), 2 deletions(-) diff --git a/mm/memory.c b/mm/memory.c index 379ebbb834565..38019497d8d4f 100644 --- a/mm/memory.c +++ b/mm/memory.c @@ -6573,6 +6573,12 @@ int generic_access_phys(struct vm_area_struct *vma, unsigned long addr, bool writable; struct follow_pfnmap_args args = { .vma = vma, .address = addr }; + /* + * Limit access to one page at a time, as that's what follow_pfnmap_start() + * guarantees; expect the caller to retry to read larger ranges. + */ + len = min_t(int, len, PAGE_SIZE - offset); + retry: if (follow_pfnmap_start(&args)) return -EINVAL; @@ -6597,7 +6603,7 @@ int generic_access_phys(struct vm_area_struct *vma, unsigned long addr, if ((write & FOLL_WRITE) && !writable) return -EINVAL; - maddr = ioremap_prot(phys_addr, PAGE_ALIGN(len + offset), prot); + maddr = ioremap_prot(phys_addr, PAGE_SIZE, prot); if (!maddr) return -ENOMEM; @@ -6605,7 +6611,7 @@ int generic_access_phys(struct vm_area_struct *vma, unsigned long addr, goto out_unmap; if ((prot != pgprot_val(args.pgprot)) || - (phys_addr != (args.pfn << PAGE_SHIFT)) || + (phys_addr != ((resource_size_t)args.pfn << PAGE_SHIFT)) || (writable != args.writable)) { follow_pfnmap_end(&args); iounmap(maddr); -- 2.53.0