From: Andrew Morton <akpm@linux-foundation.org>
To: akpm@linux-foundation.org, david@redhat.com,
hushiyuan@huawei.com, jgg@nvidia.com, linmiaohe@huawei.com,
linux-mm@kvack.org, liuzixian4@huawei.com,
louhongxiang@huawei.com, mm-commits@vger.kernel.org,
torvalds@linux-foundation.org, willy@infradead.org
Subject: [patch 12/12] mm/mmap.c: fix mmap return value when vma is merged after call_mmap()
Date: Sat, 05 Dec 2020 22:15:15 -0800 [thread overview]
Message-ID: <20201206061515.sa2v5S_CL%akpm@linux-foundation.org> (raw)
In-Reply-To: <20201205221412.67f14b9b3a5ef531c76dd452@linux-foundation.org>
From: Liu Zixian <liuzixian4@huawei.com>
Subject: mm/mmap.c: fix mmap return value when vma is merged after call_mmap()
On success, mmap should return the begin address of newly mapped area, but
patch "mm: mmap: merge vma after call_mmap() if possible" set vm_start of
newly merged vma to return value addr. Users of mmap will get wrong
address if vma is merged after call_mmap(). We fix this by moving the
assignment to addr before merging vma.
We have a driver which changes vm_flags, and this bug is found by our
testcases.
Link: https://lkml.kernel.org/r/20201203085350.22624-1-liuzixian4@huawei.com
Fixes: d70cec898324 ("mm: mmap: merge vma after call_mmap() if possible")
Signed-off-by: Liu Zixian <liuzixian4@huawei.com>
Reviewed-by: Jason Gunthorpe <jgg@nvidia.com>
Reviewed-by: David Hildenbrand <david@redhat.com>
Cc: Miaohe Lin <linmiaohe@huawei.com>
Cc: Hongxiang Lou <louhongxiang@huawei.com>
Cc: Hu Shiyuan <hushiyuan@huawei.com>
Cc: Matthew Wilcox <willy@infradead.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
---
mm/mmap.c | 26 ++++++++++++--------------
1 file changed, 12 insertions(+), 14 deletions(-)
--- a/mm/mmap.c~fix-mmap-return-value-when-vma-is-merged-after-call_mmap
+++ a/mm/mmap.c
@@ -1808,6 +1808,17 @@ unsigned long mmap_region(struct file *f
if (error)
goto unmap_and_free_vma;
+ /* Can addr have changed??
+ *
+ * Answer: Yes, several device drivers can do it in their
+ * f_op->mmap method. -DaveM
+ * Bug: If addr is changed, prev, rb_link, rb_parent should
+ * be updated for vma_link()
+ */
+ WARN_ON_ONCE(addr != vma->vm_start);
+
+ addr = vma->vm_start;
+
/* If vm_flags changed after call_mmap(), we should try merge vma again
* as we may succeed this time.
*/
@@ -1822,25 +1833,12 @@ unsigned long mmap_region(struct file *f
fput(vma->vm_file);
vm_area_free(vma);
vma = merge;
- /* Update vm_flags and possible addr to pick up the change. We don't
- * warn here if addr changed as the vma is not linked by vma_link().
- */
- addr = vma->vm_start;
+ /* Update vm_flags to pick up the change. */
vm_flags = vma->vm_flags;
goto unmap_writable;
}
}
- /* Can addr have changed??
- *
- * Answer: Yes, several device drivers can do it in their
- * f_op->mmap method. -DaveM
- * Bug: If addr is changed, prev, rb_link, rb_parent should
- * be updated for vma_link()
- */
- WARN_ON_ONCE(addr != vma->vm_start);
-
- addr = vma->vm_start;
vm_flags = vma->vm_flags;
} else if (vm_flags & VM_SHARED) {
error = shmem_zero_setup(vma);
_
prev parent reply other threads:[~2020-12-06 6:15 UTC|newest]
Thread overview: 17+ messages / expand[flat|nested] mbox.gz Atom feed top
2020-12-06 6:14 incoming Andrew Morton
2020-12-06 6:14 ` [patch 01/12] zlib: export S390 symbols for zlib modules Andrew Morton
2020-12-07 9:03 ` Zaslonko Mikhail
2020-12-08 0:45 ` Randy Dunlap
2020-12-08 8:19 ` Zaslonko Mikhail
2020-12-18 22:18 ` Randy Dunlap
2020-12-06 6:14 ` [patch 02/12] coredump: fix core_pattern parse error Andrew Morton
2020-12-06 6:14 ` [patch 03/12] mm: memcg/slab: fix obj_cgroup_charge() return value handling Andrew Morton
2020-12-06 6:14 ` [patch 04/12] mm: list_lru: set shrinker map bit when child nr_items is not zero Andrew Morton
2020-12-06 6:14 ` [patch 05/12] mm/zsmalloc.c: drop ZSMALLOC_PGTABLE_MAPPING Andrew Morton
2020-12-06 6:14 ` [patch 06/12] mm/swapfile: do not sleep with a spin lock held Andrew Morton
2020-12-06 6:14 ` [patch 07/12] mailmap: add two more addresses of Uwe Kleine-König Andrew Morton
2020-12-06 6:15 ` [patch 08/12] tools/testing/selftests/vm: fix build error Andrew Morton
2020-12-06 6:15 ` [patch 09/12] userfaultfd: selftests: fix SIGSEGV if huge mmap fails Andrew Morton
2020-12-06 6:15 ` [patch 10/12] mm/filemap: add static for function __add_to_page_cache_locked Andrew Morton
2020-12-06 6:15 ` [patch 11/12] hugetlb_cgroup: fix offline of hugetlb cgroup with reservations Andrew Morton
2020-12-06 6:15 ` Andrew Morton [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20201206061515.sa2v5S_CL%akpm@linux-foundation.org \
--to=akpm@linux-foundation.org \
--cc=david@redhat.com \
--cc=hushiyuan@huawei.com \
--cc=jgg@nvidia.com \
--cc=linmiaohe@huawei.com \
--cc=linux-mm@kvack.org \
--cc=liuzixian4@huawei.com \
--cc=louhongxiang@huawei.com \
--cc=mm-commits@vger.kernel.org \
--cc=torvalds@linux-foundation.org \
--cc=willy@infradead.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).