Add a check that the requested protection bits does not exceed the maximum protection bits.
Signed-off-by: Amit Daniel Kachhap amit.kachhap@arm.com --- mm/mmap.c | 6 ++++++ 1 file changed, 6 insertions(+)
diff --git a/mm/mmap.c b/mm/mmap.c index e8e9190f26cb..3bd230e0b565 100644 --- a/mm/mmap.c +++ b/mm/mmap.c @@ -1262,9 +1262,15 @@ user_uintptr_t do_mmap(struct file *file, user_uintptr_t user_addr, * Introduce checks for PCuABI: * - MAP_GROWSDOWN flag do not have fixed bounds and hence not * supported in PCuABI reservation model. + * - PCuABI reservation model introduces the concept of maximum + * protection the mappings can have. Add a check to make sure the + * requested protection does not exceed the maximum protection. */ if (flags & MAP_GROWSDOWN) return -EOPNOTSUPP; + if ((PROT_MAX_EXTRACT(prot) != 0) && + ((PROT_EXTRACT(prot) & PROT_MAX_EXTRACT(prot)) != PROT_EXTRACT(prot))) + return -EINVAL; if (cheri_tag_get(user_addr)) { if (!capability_owns_range(user_addr, addr, len) || !(flags & MAP_FIXED)) return -EINVAL;