diff options
| author |   Matthew Wilcox (Oracle) <willy@infradead.org> | 2023-02-03 16:28:40 -0500 |
|---|---|---|
| committer |   Andrew Morton <akpm@linux-foundation.org> | 2023-02-09 16:51:30 -0800 |
| commit | c643e6ebedb435bcf863001f5e69a578f2658055 (patch) | |
| tree | 278d5a939aea70c67e3d379de241d48895e8824b /lib/test_maple_tree.c | |
| parent | arm/mm: fix swp type masking in __swp_entry() (diff) | |
| download | wireguard-linux-c643e6ebedb435bcf863001f5e69a578f2658055.tar.xz wireguard-linux-c643e6ebedb435bcf863001f5e69a578f2658055.zip | |
mm: fix memcpy_from_file_folio() integer underflow
If we have a HIGHMEM system with a large folio, 'offset' may be larger
than PAGE_SIZE, and so min_t will cap at 'len' instead of the intended
end-of-page. That can overflow into the next page which is likely to be
unmapped and fault, but could theoretically copy the wrong data.
Link: https://lkml.kernel.org/r/Y919vmSrtAgsf6K3@casper.infradead.org
Fixes: 00cdf76012ab ("mm: add memcpy_from_file_folio()")
Signed-off-by: Matthew Wilcox (Oracle) <willy@infradead.org>
Cc: "Fabio M. De Francesco" <fmdefrancesco@gmail.com>
Cc: Ira Weiny <ira.weiny@intel.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Diffstat (limited to 'lib/test_maple_tree.c')
0 files changed, 0 insertions, 0 deletions