Re: [PATCH] mm: mremap: validate input before taking lock

Re: [PATCH] mm: mremap: validate input before taking lock

[Rasmus Villemoes]

Ping...

Rasmus Villemoes <linux@rasmusvillemoes.dk> writes:

> This patch is very similar to 84d96d897671: Perform some basic
> validation of the input to mremap() before taking the
> &current->mm->mmap_sem lock. This also makes the MREMAP_FIXED =>
> MREMAP_MAYMOVE dependency slightly more explicit.
>
> Signed-off-by: Rasmus Villemoes <linux@rasmusvillemoes.dk>
> ---
>  mm/mremap.c |   18 ++++++++++--------
>  1 file changed, 10 insertions(+), 8 deletions(-)
>
> diff --git a/mm/mremap.c b/mm/mremap.c
> index 463a257..00b6905 100644
> --- a/mm/mremap.c
> +++ b/mm/mremap.c
> @@ -456,13 +456,14 @@ SYSCALL_DEFINE5(mremap, unsigned long, addr, unsigned long, old_len,
>  	unsigned long charged = 0;
>  	bool locked = false;
>  
> -	down_write(&current->mm->mmap_sem);
> -
>  	if (flags & ~(MREMAP_FIXED | MREMAP_MAYMOVE))
> -		goto out;
> +		return ret;
> +
> +	if (flags & MREMAP_FIXED && !(flags & MREMAP_MAYMOVE))
> +		return ret;
>  
>  	if (addr & ~PAGE_MASK)
> -		goto out;
> +		return ret;
>  
>  	old_len = PAGE_ALIGN(old_len);
>  	new_len = PAGE_ALIGN(new_len);
> @@ -473,12 +474,13 @@ SYSCALL_DEFINE5(mremap, unsigned long, addr, unsigned long, old_len,
>  	 * a zero new-len is nonsensical.
>  	 */
>  	if (!new_len)
> -		goto out;
> +		return ret;
> +
> +	down_write(&current->mm->mmap_sem);
>  
>  	if (flags & MREMAP_FIXED) {
> -		if (flags & MREMAP_MAYMOVE)
> -			ret = mremap_to(addr, old_len, new_addr, new_len,
> -					&locked);
> +		ret = mremap_to(addr, old_len, new_addr, new_len,
> +				&locked);
>  		goto out;
>  	}
>  
> -- 
> 1.7.9.5
>
> --
> To unsubscribe, send a message with 'unsubscribe linux-mm' in
> the body to majordomo@kvack.org.  For more info on Linux MM,
> see: http://www.linux-mm.org/ .
> Don't email: <a href=mailto:"dont@kvack.org"> email@kvack.org </a>
>

-- 
Rasmus Villemoes
<http://rasmusvillemoes.dk/>