Robert Bragg 5dc3318528 mm: don't allow ioremapping of ranges larger than vmalloc space ... When running with a 16M IOREMAP_MAX_ORDER (on armv7) we found that the vmlist search routine in __get_vm_area_node can mistakenly allow a driver to ioremap a range larger than vmalloc space. If at the time of the ioremap all existing vmlist areas sit below the determined alignment then the search routine continues past all entries and exits the for loop - straight into the found: label - without ever testing for integer wrapping or that the requested size fits. We were seeing a driver successfully ioremap 128M of flash even though there was only 120M of vmalloc space. From that point the system was left with the remainder of the first 16M of space to vmalloc/ioremap within. Signed-off-by: Robert Bragg <robert@sixbynine.org> Acked-by: Nick Piggin <npiggin@suse.de> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>		2008-02-05 09:44:18 -08:00
..
allocpercpu.c	Slab allocators: Replace explicit zeroing with __GFP_ZERO	2007-07-17 10:23:02 -07:00
backing-dev.c	mm/backing-dev.c: fix percpu_counter_destroy call bug in bdi_init	2007-12-05 09:21:18 -08:00
bootmem.c
bounce.c	block: Initial support for data-less (or empty) barrier support	2007-10-16 11:03:56 +02:00
fadvise.c
filemap_xip.c	Pagecache zeroing: zero_user_segment, zero_user_segments and zero_user	2008-02-05 09:44:13 -08:00
filemap.c	radix-tree: avoid atomic allocations for preloaded insertions	2008-02-05 09:44:17 -08:00
fremap.c	sys_remap_file_pages: fix ->vm_file accounting	2008-02-05 09:44:07 -08:00
highmem.c	Create the ZONE_MOVABLE zone	2007-07-17 10:22:59 -07:00
hugetlb.c	fix hugepages leak due to pagetable page sharing	2008-01-24 08:07:27 -08:00
internal.h	Breakout page_order() to internal.h to avoid special knowledge of the buddy allocator	2007-10-16 09:43:01 -07:00
Kconfig	sh: Bump number of quicklists for SH-5.	2008-01-28 13:18:55 +09:00
madvise.c
Makefile	maps4: make page monitoring /proc file optional	2008-02-05 09:44:17 -08:00
memory_hotplug.c	Page allocator: clean up pcp draining functions	2008-02-05 09:44:17 -08:00
memory.c	add mm argument to pte/pmd/pud/pgd_free	2008-02-05 09:44:18 -08:00
mempolicy.c	Migration: find correct vma in new_vma_page()	2007-11-14 18:45:38 -08:00
mempool.c	spelling fixes: mm/	2007-10-20 01:27:18 +02:00
migrate.c	maps4: move is_swap_pte	2008-02-05 09:44:16 -08:00
mincore.c
mlock.c
mmap.c	arch_rebalance_pgtables call	2008-02-05 09:44:18 -08:00
mmzone.c
mprotect.c	fix mprotect vma_wants_writenotify prot	2007-10-23 08:32:06 -07:00
mremap.c	sparse pointer use of zero as null	2007-10-18 14:37:31 -07:00
msync.c
nommu.c	vmalloc: add const to void* parameters	2008-02-05 09:44:14 -08:00
oom_kill.c	sched: sched_rt_entity	2008-01-25 21:08:27 +01:00
page_alloc.c	Page allocator: clean up pcp draining functions	2008-02-05 09:44:17 -08:00
page_io.c	Drop 'size' argument from bio_endio and bi_end_io	2007-10-10 09:25:57 +02:00
page_isolation.c	memory hotremove: unset migrate type "ISOLATE" after removal	2007-11-14 18:45:38 -08:00
page-writeback.c	mm/page-writeback.c: make a function static	2008-02-05 09:44:17 -08:00
pagewalk.c	maps4: introduce a generic page walker	2008-02-05 09:44:16 -08:00
pdflush.c	Freezer: make kernel threads nonfreezable by default	2007-07-17 10:23:02 -07:00
prio_tree.c	spelling fixes: mm/	2007-10-20 01:27:18 +02:00
quicklist.c	quicklists: Only consider memory that can be used with GFP_KERNEL	2008-01-14 08:52:22 -08:00
readahead.c	mm: bdi init hooks	2007-10-17 08:42:45 -07:00
rmap.c	radix-tree: avoid atomic allocations for preloaded insertions	2008-02-05 09:44:17 -08:00
shmem_acl.c
shmem.c	tmpfs: fix shmem_swaplist races	2008-02-05 09:44:16 -08:00
slab.c	cpu-hotplug: replace per-subsystem mutexes with get_online_cpus()	2008-01-25 21:08:02 +01:00
slob.c	Avoid double memclear() in SLOB/SLUB	2007-12-09 10:17:52 -08:00
slub.c	SLUB: Do not upset lockdep	2008-02-04 10:56:02 -08:00
sparse-vmemmap.c	memory hotplug fix: fix section mismatch in vmammap_allock_block()	2007-11-29 09:24:54 -08:00
sparse.c	is_vmalloc_addr(): Check if an address is within the vmalloc boundaries	2008-02-05 09:44:14 -08:00
swap_state.c	tmpfs: move swap swizzling into shmem	2008-02-05 09:44:15 -08:00
swap.c	spelling fixes: mm/	2007-10-20 01:27:18 +02:00
swapfile.c	tmpfs: open a window in shmem_unuse_inode	2008-02-05 09:44:15 -08:00
thrash.c
tiny-shmem.c	Remove unused code from mm/tiny-shmem.c	2008-02-05 09:44:17 -08:00
truncate.c	Pagecache zeroing: zero_user_segment, zero_user_segments and zero_user	2008-02-05 09:44:13 -08:00
util.c	fix mm/util.c:krealloc()	2007-11-14 18:45:41 -08:00
vmalloc.c	mm: don't allow ioremapping of ranges larger than vmalloc space	2008-02-05 09:44:18 -08:00
vmscan.c	spelling fixes: mm/	2007-10-20 01:27:18 +02:00
vmstat.c	vmstat: small revisions to refresh_cpu_vm_stats()	2008-02-05 09:44:18 -08:00