[PATCH] mtd: phram: reject non-RAM ranges for module parameters

[Rahul Kumar]

Writing a bogus address such as "p0,0x8000000000000000,0x1000" to
/sys/module/phram/parameters/phram reaches ioremap() and triggers
WARNING in __ioremap_caller on x86. On arm64 a non-RAM address can
map and later Oops in memcpy when FTL scans the device.

For module-parameter devices, require the range to be System RAM
before mapping. Also default that path to memremap(), matching DT
without "no-map".

Fixes: 9401911f2d9f ("mtd: phram: Allow cached mappings")
Reported-by: syzbot+eaaabe90f486cb6f31b2 at syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=eaaabe90f486cb6f31b2
Reported-by: syzbot+061cb4ee001379dbbfaf at syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=061cb4ee001379dbbfaf
Signed-off-by: Rahul Kumar <rk0006818 at gmail.com>
---
 drivers/mtd/devices/phram.c | 11 +++++++++--
 1 file changed, 9 insertions(+), 2 deletions(-)

diff --git a/drivers/mtd/devices/phram.c b/drivers/mtd/devices/phram.c
index b42cadcd76b1..9747e7e58e6f 100644
--- a/drivers/mtd/devices/phram.c
+++ b/drivers/mtd/devices/phram.c
@@ -19,6 +19,7 @@
 #define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
 
 #include <linux/io.h>
+#include <linux/ioport.h>
 #include <linux/init.h>
 #include <linux/kernel.h>
 #include <linux/list.h>
@@ -126,10 +127,16 @@ static int register_device(struct platform_device *pdev, const char *name,
 			   phys_addr_t start, size_t len, uint32_t erasesize)
 {
 	struct device_node *np = pdev ? pdev->dev.of_node : NULL;
-	bool cached = np ? !of_property_read_bool(np, "no-map") : false;
+	bool cached = np ? !of_property_read_bool(np, "no-map") : true;
 	struct phram_mtd_list *new;
 	int ret = -ENOMEM;
 
+	if (!np && region_intersects(start, len, IORESOURCE_SYSTEM_RAM,
+				     IORES_DESC_NONE) != REGION_INTERSECTS) {
+		pr_err("start/len is not System RAM\n");
+		return -EINVAL;
+	}
+
 	new = kzalloc_obj(*new);
 	if (!new)
 		goto out0;
@@ -138,7 +145,7 @@ static int register_device(struct platform_device *pdev, const char *name,
 
 	ret = phram_map(new, start, len);
 	if (ret) {
-		pr_err("ioremap failed\n");
+		pr_err("failed to map memory\n");
 		goto out1;
 	}
 
-- 
2.52.0