[PATCH] char: mem: reject wrapped physical ranges

[Yousef Alhouseen]

The generic /dev/mem range check validates addr + count directly. A
large count can wrap the physical address calculation and pass the check
against high_memory.

Use subtraction-based range validation so read_mem() and write_mem()
reject ranges that either start past the limit or extend beyond it.

Signed-off-by: Yousef Alhouseen <alhouseenyousef@xxxxxxxxx>
---
 drivers/char/mem.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/drivers/char/mem.c b/drivers/char/mem.c
index 63253d1de..9e22b18f7 100644
--- a/drivers/char/mem.c
+++ b/drivers/char/mem.c
@@ -47,7 +47,9 @@ static inline unsigned long size_inside_page(unsigned long start,
 #ifndef ARCH_HAS_VALID_PHYS_ADDR_RANGE
 static inline int valid_phys_addr_range(phys_addr_t addr, size_t count)
 {
-	return addr + count <= __pa(high_memory);
+	phys_addr_t end = __pa(high_memory);
+
+	return addr <= end && count <= end - addr;
 }
 
 static inline int valid_mmap_phys_addr_range(unsigned long pfn, size_t size)
-- 
2.54.0