mm: mremap: validate input before taking lock
This patch is very similar to commit 84d96d8976
("mm: madvise:
complete input validation before taking lock"): perform some basic
validation of the input to mremap() before taking the
¤t->mm->mmap_sem lock.
This also makes the MREMAP_FIXED => MREMAP_MAYMOVE dependency slightly
more explicit.
Signed-off-by: Rasmus Villemoes <linux@rasmusvillemoes.dk>
Cc: KOSAKI Motohiro <kosaki.motohiro@jp.fujitsu.com>
Cc: David Rientjes <rientjes@google.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
hifive-unleashed-5.1
parent
34e3a58c66
commit
9a2458a633
18
mm/mremap.c
18
mm/mremap.c
|
@ -456,13 +456,14 @@ SYSCALL_DEFINE5(mremap, unsigned long, addr, unsigned long, old_len,
|
||||||
unsigned long charged = 0;
|
unsigned long charged = 0;
|
||||||
bool locked = false;
|
bool locked = false;
|
||||||
|
|
||||||
down_write(¤t->mm->mmap_sem);
|
|
||||||
|
|
||||||
if (flags & ~(MREMAP_FIXED | MREMAP_MAYMOVE))
|
if (flags & ~(MREMAP_FIXED | MREMAP_MAYMOVE))
|
||||||
goto out;
|
return ret;
|
||||||
|
|
||||||
|
if (flags & MREMAP_FIXED && !(flags & MREMAP_MAYMOVE))
|
||||||
|
return ret;
|
||||||
|
|
||||||
if (addr & ~PAGE_MASK)
|
if (addr & ~PAGE_MASK)
|
||||||
goto out;
|
return ret;
|
||||||
|
|
||||||
old_len = PAGE_ALIGN(old_len);
|
old_len = PAGE_ALIGN(old_len);
|
||||||
new_len = PAGE_ALIGN(new_len);
|
new_len = PAGE_ALIGN(new_len);
|
||||||
|
@ -473,12 +474,13 @@ SYSCALL_DEFINE5(mremap, unsigned long, addr, unsigned long, old_len,
|
||||||
* a zero new-len is nonsensical.
|
* a zero new-len is nonsensical.
|
||||||
*/
|
*/
|
||||||
if (!new_len)
|
if (!new_len)
|
||||||
goto out;
|
return ret;
|
||||||
|
|
||||||
|
down_write(¤t->mm->mmap_sem);
|
||||||
|
|
||||||
if (flags & MREMAP_FIXED) {
|
if (flags & MREMAP_FIXED) {
|
||||||
if (flags & MREMAP_MAYMOVE)
|
ret = mremap_to(addr, old_len, new_addr, new_len,
|
||||||
ret = mremap_to(addr, old_len, new_addr, new_len,
|
&locked);
|
||||||
&locked);
|
|
||||||
goto out;
|
goto out;
|
||||||
}
|
}
|
||||||
|
|
||||||
|
|
Loading…
Reference in New Issue