area->size can include adjacent guard page but get_vm_area_size() returns actual size of the area.
This fixes possible kernel crash when userspace tries to map area on 1 page bigger: size check passes but the following vmalloc_to_page() returns NULL on last guard (non-existing) page. Signed-off-by: Roman Penyaev <[email protected]> Cc: Andrew Morton <[email protected]> Cc: Michal Hocko <[email protected]> Cc: Andrey Ryabinin <[email protected]> Cc: Joe Perches <[email protected]> Cc: "Luis R. Rodriguez" <[email protected]> Cc: [email protected] Cc: [email protected] Cc: [email protected] --- mm/vmalloc.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/mm/vmalloc.c b/mm/vmalloc.c index 871e41c55e23..2cd24186ba84 100644 --- a/mm/vmalloc.c +++ b/mm/vmalloc.c @@ -2248,7 +2248,7 @@ int remap_vmalloc_range_partial(struct vm_area_struct *vma, unsigned long uaddr, if (!(area->flags & VM_USERMAP)) return -EINVAL; - if (kaddr + size > area->addr + area->size) + if (kaddr + size > area->addr + get_vm_area_size(area)) return -EINVAL; do { -- 2.19.1
