Function memory_contains() checks whether a memory object is
entirely contained within a memory region. The condition that
checks the upper bound of the object against the upper bound
of the region is inclusive. That does not correspond to the
similar checks in memory_intersects() friend function, nor
to the actual regions memory_contains() is called against.
In particular, __init_end address assumed do not belong to
the init section itself. Similarly, on ARM __idmap_text_end
and __entry_text_end are affected.
Fixes: 979559362516 ("asm/sections: add helpers to check for section data")
Cc: Thierry Reding <[email protected]>
Cc: Arnd Bergmann <[email protected]>
Cc: Russell King <[email protected]>
Cc: [email protected]
Signed-off-by: Alexander Gordeev <[email protected]>
---
include/asm-generic/sections.h | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/include/asm-generic/sections.h b/include/asm-generic/sections.h
index 1dfadb2e878d..23f325cd2c66 100644
--- a/include/asm-generic/sections.h
+++ b/include/asm-generic/sections.h
@@ -78,7 +78,7 @@ extern __visible const void __nosave_begin, __nosave_end;
static inline bool memory_contains(void *begin, void *end, void *virt,
size_t size)
{
- return virt >= begin && virt + size <= end;
+ return virt >= begin && virt + size < end;
}
/**
--
2.32.0
On Tue, Dec 21, 2021 at 08:06:24AM +0100, Alexander Gordeev wrote:
> Function memory_contains() checks whether a memory object is
> entirely contained within a memory region. The condition that
> checks the upper bound of the object against the upper bound
> of the region is inclusive. That does not correspond to the
> similar checks in memory_intersects() friend function, nor
> to the actual regions memory_contains() is called against.
>
> In particular, __init_end address assumed do not belong to
> the init section itself. Similarly, on ARM __idmap_text_end
> and __entry_text_end are affected.
__init_end is exclusive as are the other symbols you mention here.
They point at the byte immediately following the area.
When testing an virt + size, the resulting address of "virt + size" is
always exclusive - this also points at the byte immediately following
the range of addresses. The preceeding byte is part of the object.
For example, if size is one, then we have a single byte, which is at
address "virt". "virt + 1" is not part of the object. Therefore, if
size is 1MiB, then "virt + 1048576" is similarly not part of the
object.
Hence, we _do_ want to test address + size <= end.
This code appears to me to be correct, and this patch _introduces_ a
bug.
--
RMK's Patch system: https://www.armlinux.org.uk/developer/patches/
FTTP is here! 40Mbps down 10Mbps up. Decent connectivity at last!