From 91e49e5534a86137c3c6f2ac75ba483e152c22b1 Mon Sep 17 00:00:00 2001 From: Orson Zhai Date: Mon, 8 Nov 2021 18:11:47 +0800 Subject: [PATCH] ANDROID: userfaultfd: Fix untag pointer in userfaultfd_continue() Fixes e71e2ace5721 ("userfaultfd: do not untag user pointers"). Above patch is ported from upstream into LTS branch then merged into android12-5.4. The original patch was going to fix all untag user pointers. The change to userfaultfd_continue() was cut off when being merged into LTS because the routine does not exist in LTS. But specially the routine has been cherry-picked into android12-5.4 with commit b69f713e60d0 ("BACKPORT: FROMGIT: userfaultfd: add UFFDIO_CONTINUE ioctl") by Lokesh Gidra long ago. So add back the missing part of fixing here. Fixes: e71e2ace5721 ("userfaultfd: do not untag user pointers") Change-Id: I32da80c2e9517356daadf566a433e056f6bef08c Signed-off-by: Orson Zhai --- fs/userfaultfd.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/fs/userfaultfd.c b/fs/userfaultfd.c index 040fa935c4ef..300f6190fb54 100644 --- a/fs/userfaultfd.c +++ b/fs/userfaultfd.c @@ -1862,7 +1862,7 @@ static int userfaultfd_continue(struct userfaultfd_ctx *ctx, unsigned long arg) sizeof(uffdio_continue) - (sizeof(__s64)))) goto out; - ret = validate_range(ctx->mm, &uffdio_continue.range.start, + ret = validate_range(ctx->mm, uffdio_continue.range.start, uffdio_continue.range.len); if (ret) goto out;