Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 31b4beb4 authored by Kirill A. Shutemov's avatar Kirill A. Shutemov Committed by Linus Torvalds
Browse files

ipc/shm: fix crash if CONFIG_SHMEM is not set 

Commit c01d5b30 ("shmem: get_unmapped_area align huge page") makes
use of shm_get_unmapped_area() in shm_file_operations() unconditional to
CONFIG_MMU.

As Tony Battersby pointed this can lead NULL-pointer dereference on
machine with CONFIG_MMU=y and CONFIG_SHMEM=n.  In this case ipc/shm is
backed by ramfs which doesn't provide f_op->get_unmapped_area for
configurations with MMU.

The solution is to provide dummy f_op->get_unmapped_area for ramfs when
CONFIG_MMU=y, which just call current->mm->get_unmapped_area().

Fixes: c01d5b30 ("shmem: get_unmapped_area align huge page")
Link: http://lkml.kernel.org/r/20160912102704.140442-1-kirill.shutemov@linux.intel.com


Signed-off-by: default avatarKirill A. Shutemov <kirill.shutemov@linux.intel.com>
Reported-by: default avatarTony Battersby <tonyb@cybernetics.com>
Tested-by: default avatarTony Battersby <tonyb@cybernetics.com>
Cc: Hugh Dickins <hughd@google.com>
Cc: <stable@vger.kernel.org>	[4.7.x]
Signed-off-by: default avatarAndrew Morton <akpm@linux-foundation.org>
Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
parent c8de641b

fs/ramfs/file-mmu.c

+9 −0
Original line number Diff line number Diff line
@@ -27,9 +27,17 @@ 
#include <linux/fs.h>

#include <linux/mm.h>

#include <linux/ramfs.h>

#include <linux/sched.h>



#include "internal.h"



static unsigned long ramfs_mmu_get_unmapped_area(struct file *file,

		unsigned long addr, unsigned long len, unsigned long pgoff,

		unsigned long flags)

{

	return current->mm->get_unmapped_area(file, addr, len, pgoff, flags);

}



const struct file_operations ramfs_file_operations = {

	.read_iter	= generic_file_read_iter,

	.write_iter	= generic_file_write_iter,
@@ -38,6 +46,7 @@ const struct file_operations ramfs_file_operations = { 
	.splice_read	= generic_file_splice_read,

	.splice_write	= iter_file_splice_write,

	.llseek		= generic_file_llseek,

	.get_unmapped_area	= ramfs_mmu_get_unmapped_area,

};



const struct inode_operations ramfs_file_inode_operations = {