Messages in this thread | | | Date | Tue, 29 Oct 2013 09:44:24 +0100 | From | Paolo Minazzi <> | Subject | bug in generic_access_phys (mm/memory.c) ? |
| |
Hi to all, I think the function "generic_access_phys" in mm/memory.c has got a small bug. THe ioremap_prot is called with the parameter size=PAGE_SIZE. But it can happen that we need more than one page, and this will produce a kernel fault.
int generic_access_phys(struct vm_area_struct *vma, unsigned long addr, void *buf, int len, int write) { resource_size_t phys_addr; unsigned long prot = 0; void __iomem *maddr; int offset = addr & (PAGE_SIZE-1);
if (follow_phys(vma, addr, write, &prot, &phys_addr)) return -EINVAL;
====> maddr = ioremap_prot(phys_addr, PAGE_SIZE);
if (write) memcpy_toio(maddr + offset, buf, len); else memcpy_fromio(buf, maddr + offset, len); iounmap(maddr);
return len; }
I think that the ioremap_prot should be changed with
maddr = ioremap_prot(phys_addr, ((phys_addr + offset + len - 1) & ~(PAGE_SIZE-1)) - phys_addr + PAGE_SIZE);
Thanks, Paolo Minazzi
| |