highmem: Check overflow in per cpu kmap fix mapping
kmap_atomic_idx_push() is unbounded. If it is crossing
per process limit of KM_TYPE_NR, then
(1) It may end up getting identical mapping for more than
1 CPUs. This is quite racy. Page corruption may result
by this.
(2) It may reach a value of 0x100 without checking its
upper bound KM_TYPE_NR. In ARM implementation of
kmap_atomic(), this can result into kmap_atomic()
returning 0 vaddr.
Fix this by putting hard upper bound even in non-debug
environments.
Change-Id: Iaabfc796b08d2580adcfc2d7e6e996c1ff392134
Signed-off-by:
Chintan Pandya <cpandya@codeaurora.org>
Loading
Please sign in to comment