Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 9a2458a6 authored by Rasmus Villemoes's avatar Rasmus Villemoes Committed by Linus Torvalds
Browse files

mm: mremap: validate input before taking lock 



This patch is very similar to commit 84d96d89 ("mm: madvise:
complete input validation before taking lock"): perform some basic
validation of the input to mremap() before taking the
&current->mm->mmap_sem lock.

This also makes the MREMAP_FIXED => MREMAP_MAYMOVE dependency slightly
more explicit.

Signed-off-by: default avatarRasmus Villemoes <linux@rasmusvillemoes.dk>
Cc: KOSAKI Motohiro <kosaki.motohiro@jp.fujitsu.com>
Cc: David Rientjes <rientjes@google.com>
Signed-off-by: default avatarAndrew Morton <akpm@linux-foundation.org>
Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
parent 34e3a58c

mm/mremap.c

+10 −8
Original line number Diff line number Diff line
@@ -456,13 +456,14 @@ SYSCALL_DEFINE5(mremap, unsigned long, addr, unsigned long, old_len, 
	unsigned long charged = 0;

	bool locked = false;



	down_write(&current->mm->mmap_sem);



	if (flags & ~(MREMAP_FIXED | MREMAP_MAYMOVE))

		goto out;

		return ret;



	if (flags & MREMAP_FIXED && !(flags & MREMAP_MAYMOVE))

		return ret;



	if (addr & ~PAGE_MASK)

		goto out;

		return ret;



	old_len = PAGE_ALIGN(old_len);

	new_len = PAGE_ALIGN(new_len);
@@ -473,10 +474,11 @@ SYSCALL_DEFINE5(mremap, unsigned long, addr, unsigned long, old_len, 
	 * a zero new-len is nonsensical.

	 */

	if (!new_len)

		goto out;

		return ret;



	down_write(&current->mm->mmap_sem);



	if (flags & MREMAP_FIXED) {

		if (flags & MREMAP_MAYMOVE)

		ret = mremap_to(addr, old_len, new_addr, new_len,

				&locked);

		goto out;