diff options
Diffstat (limited to 'arch/s390/lib/uaccess_pt.c')
| -rw-r--r-- | arch/s390/lib/uaccess_pt.c | 9 |
1 files changed, 5 insertions, 4 deletions
diff --git a/arch/s390/lib/uaccess_pt.c b/arch/s390/lib/uaccess_pt.c index 1694d738b175..0632dc50da78 100644 --- a/arch/s390/lib/uaccess_pt.c +++ b/arch/s390/lib/uaccess_pt.c @@ -74,15 +74,18 @@ static size_t copy_in_kernel(size_t count, void __user *to, /* * Returns kernel address for user virtual address. If the returned address is - * >= -4095 (IS_ERR_VALUE(x) returns true), a fault has occured and the address - * contains the (negative) exception code. + * >= -4095 (IS_ERR_VALUE(x) returns true), a fault has occurred and the + * address contains the (negative) exception code. */ #ifdef CONFIG_64BIT + static unsigned long follow_table(struct mm_struct *mm, unsigned long address, int write) { unsigned long *table = (unsigned long *)__pa(mm->pgd); + if (unlikely(address > mm->context.asce_limit - 1)) + return -0x38UL; switch (mm->context.asce_bits & _ASCE_TYPE_MASK) { case _ASCE_TYPE_REGION1: table = table + ((address >> 53) & 0x7ff); @@ -461,9 +464,7 @@ int futex_atomic_cmpxchg_pt(u32 *uval, u32 __user *uaddr, struct uaccess_ops uaccess_pt = { .copy_from_user = copy_from_user_pt, - .copy_from_user_small = copy_from_user_pt, .copy_to_user = copy_to_user_pt, - .copy_to_user_small = copy_to_user_pt, .copy_in_user = copy_in_user_pt, .clear_user = clear_user_pt, .strnlen_user = strnlen_user_pt, |
