Unverified Commit 6de90116 authored by openeuler-ci-bot's avatar openeuler-ci-bot Committed by Gitee
Browse files

!13103 CVE-2024-49878 

Merge Pull Request from: @ci-robot 
 
PR sync from: Yongqiang Liu <liuyongqiang13@huawei.com>
https://mailweb.openeuler.org/hyperkitty/list/kernel@openeuler.org/message/W57XPEBDOY2LBT6N24RZTMQE74P6GSY2/ 
Huang Ying (1):
  resource: fix region_intersects() vs add_memory_driver_managed()


-- 
2.25.1
 
https://gitee.com/src-openeuler/kernel/issues/IAYRCE 
 
Link:https://gitee.com/openeuler/kernel/pulls/13103

 

Reviewed-by: default avatarYang Yingliang <yangyingliang@huawei.com>
Signed-off-by: default avatarYang Yingliang <yangyingliang@huawei.com>
parents a234e031 ef5b60fa

kernel/resource.c

+50 −8
Original line number Diff line number Diff line
@@ -539,21 +539,63 @@ EXPORT_SYMBOL_GPL(page_is_ram); 
int region_intersects(resource_size_t start, size_t size, unsigned long flags,

		      unsigned long desc)

{

	struct resource res;

	resource_size_t ostart, oend;

	int type = 0; int other = 0;

	struct resource *p;

	struct resource *p, *dp;

	bool is_type, covered;

	struct resource res;



	res.start = start;

	res.end = start + size - 1;



	read_lock(&resource_lock);

	for (p = iomem_resource.child; p ; p = p->sibling) {

		bool is_type = (((p->flags & flags) == flags) &&

				((desc == IORES_DESC_NONE) ||

				 (desc == p->desc)));



		if (resource_overlaps(p, &res))

			is_type ? type++ : other++;

		if (!resource_overlaps(p, &res))

			continue;

		is_type = (p->flags & flags) == flags &&

			(desc == IORES_DESC_NONE || desc == p->desc);

		if (is_type) {

			type++;

			continue;

		}

		/*

		 * Continue to search in descendant resources as if the

		 * matched descendant resources cover some ranges of 'p'.

		 *

		 * |------------- "CXL Window 0" ------------|

		 * |-- "System RAM" --|

		 *

		 * will behave similar as the following fake resource

		 * tree when searching "System RAM".

		 *

		 * |-- "System RAM" --||-- "CXL Window 0a" --|

		 */

		covered = false;

		ostart = max(res.start, p->start);

		oend = min(res.end, p->end);

		for (dp = p->child; dp; dp = next_resource(dp, false)) {

			if (!resource_overlaps(dp, &res))

				continue;

			is_type = (dp->flags & flags) == flags &&

				(desc == IORES_DESC_NONE || desc == dp->desc);

			if (is_type) {

				type++;

				/*

				 * Range from 'ostart' to 'dp->start'

				 * isn't covered by matched resource.

				 */

				if (dp->start > ostart)

					break;

				if (dp->end >= oend) {

					covered = true;

					break;

				}

				/* Remove covered range */

				ostart = max(ostart, dp->end + 1);

			}

		}

		if (!covered)

			other++;

	}

	read_unlock(&resource_lock);