[POWERPC] spufs: avoid accessing kernel memory through mmapped /mem node
authorMasato Noguchi <Masato.Noguchi@jp.sony.com>
Tue, 13 Feb 2007 20:54:30 +0000 (21:54 +0100)
committerArnd Bergmann <arnd@klappe.arndb.de>
Tue, 13 Feb 2007 20:55:43 +0000 (21:55 +0100)
I found an exploit in current kernel.
Currently, there is no range check about mmapping "/mem" node in
spufs. Thus, an application can access privilege memory region.

In case this kernel already worked on a public server, I send this
information only here.
If there are such servers in somewhere, please replace it, ASAP.

Signed-off-by: Masato Noguchi <Masato.Noguchi@jp.sony.com>
Signed-off-by: Arnd Bergmann <arnd.bergmann@de.ibm.com>
arch/powerpc/platforms/cell/spufs/file.c

index c729813043a61ffee1a8ad390ecb11cfc776ba98..b00653d69c01cd654749d9a51231f6db7f258072 100644 (file)
@@ -103,6 +103,9 @@ static unsigned long spufs_mem_mmap_nopfn(struct vm_area_struct *vma,
 
        offset += vma->vm_pgoff << PAGE_SHIFT;
 
+       if (offset >= LS_SIZE)
+               return NOPFN_SIGBUS;
+
        spu_acquire(ctx);
 
        if (ctx->state == SPU_STATE_SAVED) {