[lkml]   [2013]   [Dec]   [2]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
Messages in this thread
Patch in this message
Subject[PATCH 3.12 153/212] s390/uaccess: add missing page table walk range check
3.12-stable review patch.  If anyone has any objections, please let me know.


From: Heiko Carstens <>

commit 71a86ef055f569b93bc6901f007bdf447dbf515f upstream.

When translating a user space address, the address must be checked against
the ASCE limit of the process. If the address is larger than the maximum
address that is reachable with the ASCE, an ASCE type exception must be

The current code simply ignored the higher order bits. This resulted in an
address wrap around in user space instead of an exception in user space.

Reviewed-by: Gerald Schaefer <>
Signed-off-by: Heiko Carstens <>
Signed-off-by: Martin Schwidefsky <>
Signed-off-by: Greg Kroah-Hartman <>

arch/s390/lib/uaccess_pt.c | 3 +++
1 file changed, 3 insertions(+)

--- a/arch/s390/lib/uaccess_pt.c
+++ b/arch/s390/lib/uaccess_pt.c
@@ -78,11 +78,14 @@ static size_t copy_in_kernel(size_t coun
* contains the (negative) exception code.
#ifdef CONFIG_64BIT
static unsigned long follow_table(struct mm_struct *mm,
unsigned long address, int write)
unsigned long *table = (unsigned long *)__pa(mm->pgd);

+ if (unlikely(address > mm->context.asce_limit - 1))
+ return -0x38UL;
switch (mm->context.asce_bits & _ASCE_TYPE_MASK) {
table = table + ((address >> 53) & 0x7ff);

 \ /
  Last update: 2013-12-02 21:21    [W:0.412 / U:0.008 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site