kernel/linux
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ synced 2026-10-18 19:12:56 +00:00
Code Issues Releases Packages Activity
linux/drivers/fpga
History
Sebastian Alba Vives d7e787eee2 fpga: dfl-afu: validate DMA mapping length in afu_dma_map_region() 
[ Upstream commit fc3b071a7c ]

afu_ioctl_dma_map() accepts a 64-bit length from userspace via
DFL_FPGA_PORT_DMA_MAP ioctl without an upper bound check. The value
is passed to afu_dma_pin_pages() where npages is derived as
length >> PAGE_SHIFT and passed to pin_user_pages_fast() which takes
int nr_pages, causing implicit truncation if length is very large.

Validate map.length at the ioctl entry point before calling
afu_dma_map_region(), rejecting values whose page count exceeds
INT_MAX.

Fixes: fa8dda1ede ("fpga: dfl: afu: add DFL_FPGA_PORT_DMA_MAP/UNMAP ioctls support")
Cc: stable@vger.kernel.org
Signed-off-by: Sebastian Alba Vives <sebasjosue84@gmail.com>
Reviewed-by: Xu Yilun <yilun.xu@intel.com>
Link: https://lore.kernel.org/r/20260518190742.61426-3-sebasjosue84@gmail.com
Signed-off-by: Xu Yilun <yilun.xu@linux.intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
History 2026-08-23 14:17:17 +02:00
..
altera-cvp.c fpga: altera-cvp: Increase credit timeout 2025-06-04 14:37:59 +02:00
altera-fpga2sdram.c fpga: bridge: add devm_fpga_bridge_create 2018-10-16 11:13:50 +02:00
altera-freeze-bridge.c fpga: altera-freeze-bridge: Address warning about unused variable 2021-07-24 15:10:30 -07:00
altera-hps2fpga.c fpga: bridge: add devm_fpga_bridge_create 2018-10-16 11:13:50 +02:00
altera-pr-ip-core-plat.c fpga: fpga-mgr: altera-pr-ip: Simplify registration 2020-12-01 18:49:32 +01:00
altera-pr-ip-core.c fpga: altera-pr-ip: fix unsigned comparison with less than zero 2022-08-17 14:23:41 +02:00
altera-ps-spi.c fpga: fpga-mgr: altera-ps-spi: Simplify registration 2020-12-01 18:49:32 +01:00
dfl-afu-dma-region.c fpga: dfl: afu: convert get_user_pages() --> pin_user_pages() 2020-06-18 18:12:06 -07:00
dfl-afu-error.c fpga: dfl: afu: harden port enable logic 2021-03-24 11:15:04 -07:00
dfl-afu-main.c fpga: dfl-afu: validate DMA mapping length in afu_dma_map_region() 2026-08-23 14:17:17 +02:00
dfl-afu-region.c fpga: dfl: afu: add afu sub feature support 2018-07-15 13:55:47 +02:00
dfl-afu.h fpga: dfl: afu: harden port enable logic 2021-03-24 11:15:04 -07:00
dfl-fme-br.c fpga: bridge: add devm_fpga_bridge_create 2018-10-16 11:13:50 +02:00
dfl-fme-error.c fpga: dfl: fme: add interrupt support for global error reporting 2020-07-06 21:35:42 -07:00
dfl-fme-main.c fpga: dfl: fme: add interrupt support for global error reporting 2020-07-06 21:35:42 -07:00
dfl-fme-mgr.c fpga: fpga-mgr: wrap the state() op 2021-07-24 15:10:31 -07:00
dfl-fme-perf.c fpga: dfl: fme: Fix cpu hotplug issue in performance reporting 2021-07-27 11:05:16 -07:00
dfl-fme-pr.c fpga: fix spelling mistakes 2021-07-21 19:54:21 -07:00
dfl-fme-pr.h fpga: dfl: fme: add partial reconfiguration sub feature support 2018-07-15 13:55:46 +02:00
dfl-fme-region.c fpga: region: Use standard dev_release for class driver 2024-06-16 13:39:38 +02:00
dfl-fme.h fpga: dfl: fme: add performance reporting support 2020-04-28 15:49:28 +02:00
dfl-n3000-nios.c fpga: fix spelling mistakes 2021-07-21 19:54:21 -07:00
dfl-pci.c fpga: dfl: pci: add device IDs for Silicom N501x PAC cards 2021-07-24 15:10:30 -07:00
dfl.c fpga: dfl: use subsys_initcall to allow built-in drivers to be added 2026-03-04 07:20:25 -05:00
dfl.h fpga: dfl: expose feature revision from struct dfl_device 2021-07-29 12:54:10 -07:00
fpga-bridge.c fpga: bridge: fix kernel-doc parameter description 2023-05-11 23:00:31 +09:00
fpga-mgr.c fpga: fpga-mgr: wrap the write_sg() op 2021-07-24 15:10:31 -07:00
fpga-region.c fpga: region: add owner module and take its refcount 2024-06-16 13:39:38 +02:00
ice40-spi.c fpga: ice40-spi: Add SPI device ID table 2021-09-27 14:00:41 -07:00
Kconfig FPGA Manager changes for 5.15-rc1 2021-08-05 14:26:03 +02:00
machxo2-spi.c fpga: machxo2-spi: Fix missing error code in machxo2_write_complete() 2021-09-15 14:01:24 -07:00
Makefile fpga: versal-fpga: Add versal fpga manager driver 2021-07-21 13:14:09 +02:00
of-fpga-region.c fpga: region: fix use-after-free in child_regions_with_firmware() 2026-07-04 13:39:40 +02:00
socfpga-a10.c fpga: mgr: add devm_fpga_mgr_create 2018-10-16 11:13:50 +02:00
socfpga.c fpga: fpga-mgr: socfpga: Simplify registration 2020-12-01 18:49:32 +01:00
stratix10-soc.c fpga: stratix10-soc: Fix return value check in s10_ops_write_init() 2023-02-09 11:26:44 +01:00
ts73xx-fpga.c fpga: fpga-mgr: wrap the state() op 2021-07-24 15:10:31 -07:00
versal-fpga.c fpga: versal-fpga: Remove empty functions 2021-07-27 18:46:03 +02:00
xilinx-pr-decoupler.c fpga: xilinx-pr-decoupler: Address warning about unused variable 2021-07-24 15:10:30 -07:00
xilinx-spi.c fpga: xiilnx-spi: Address warning about unused variable 2021-07-24 15:10:30 -07:00
zynq-fpga.c fpga: zynq_fpga: Fix the wrong usage of dma_map_sgtable() 2025-08-28 16:24:34 +02:00
zynqmp-fpga.c fpga: fpga-mgr: make write_complete() op optional 2021-07-24 15:10:30 -07:00