From 7c84710c1a9d393d0e151e2635eaca358d142b7c Mon Sep 17 00:00:00 2001 From: Boyang Zhou Date: Fri, 17 May 2019 14:21:37 +0800 Subject: [PATCH] arm64: mmap: Ensure file offset is treated as unsigned mainline inclusion from mainline-5.1-rc3 commit f08cae2f28db category: bugfix bugzilla: 14514 CVE: NA ------------------------------------------------- The file offset argument to the arm64 sys_mmap() implementation is scaled from bytes to pages by shifting right by PAGE_SHIFT. Unfortunately, the offset is passed in as a signed 'off_t' type and therefore large offsets (i.e. with the top bit set) are incorrectly sign-extended by the shift. This has been observed to cause false mmap() failures when mapping GPU doorbells on an arm64 server part. Change the type of the file offset argument to sys_mmap() from 'off_t' to 'unsigned long' so that the shifting scales the value as expected. Cc: Signed-off-by: Boyang Zhou [will: rewrote commit message] Signed-off-by: Will Deacon Signed-off-by: Xiongfeng Wang Reviewed-by: Yao Hongbo Signed-off-by: Yang Yingliang --- arch/arm64/kernel/sys.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/arch/arm64/kernel/sys.c b/arch/arm64/kernel/sys.c index b44065fb1616..6f91e8116514 100644 --- a/arch/arm64/kernel/sys.c +++ b/arch/arm64/kernel/sys.c @@ -31,7 +31,7 @@ SYSCALL_DEFINE6(mmap, unsigned long, addr, unsigned long, len, unsigned long, prot, unsigned long, flags, - unsigned long, fd, off_t, off) + unsigned long, fd, unsigned long, off) { if (offset_in_page(off) != 0) return -EINVAL; -- GitLab