[lkml]   [2002]   [Mar]   [26]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
Messages in this thread
Patch in this message
SubjectRe: [patch] mmap bug with drivers that adjust vm_start
On Tue, Mar 26, 2002 at 03:43:45PM -0500, Benjamin LaHaise wrote:
> I would rather see an mmap fail if it would collide with an existing mapping,
> but that might break some applications.

That doesn't make it easier though, the time we should fail is still way
earlier the relocation of the virtual address space area.

> Thanks for looking this over. Cheers,

You're welcome, thanks for fixing it.

> + if (unlikely(NULL != find_vma_prepare(mm, addr, &prev,
> + &rb_link, &rb_parent))) {

this looks wrong there may very well be a vma after our mapping but it
doesn't necessairly overlap with us (also the unlikely would make more
sense in the previous if). I hacked a bit on top of your previous patch,
this looks ok to me but it's untested:

diff -urN 2.4.19pre4aa1/mm/mmap.c vma/mm/mmap.c
--- 2.4.19pre4aa1/mm/mmap.c Tue Mar 26 20:43:07 2002
+++ vma/mm/mmap.c Tue Mar 26 20:48:24 2002
@@ -554,7 +554,26 @@
* Answer: Yes, several device drivers can do it in their
* f_op->mmap method. -DaveM
- addr = vma->vm_start;
+ if (unlikely(addr != vma->vm_start)) {
+ /*
+ * It is a bit too late to pretend changing the virtual
+ * area of the mapping, we just corrupted userspace
+ * in the do_munmap, so FIXME (not in 2.4 to avoid breaking
+ * the driver API).
+ */
+ struct vm_area_struct * stale_vma;
+ /* Since addr changed, we rely on the mmap op to prevent
+ * collisions with existing vmas and just use find_vma_prepare
+ * to update the tree pointers.
+ */
+ addr = vma->vm_start;
+ stale_vma = find_vma_prepare(mm, addr, &prev, &rb_link, &rb_parent);
+ /*
+ * Make sure the lowlevel driver did its job right.
+ */
+ if (unlikely(stale_vma && stale_vma->vm_start < vma->vm_end))
+ BUG();
+ }

vma_link(mm, vma, prev, rb_link, rb_parent);
if (correct_wcount)

your printk also is valid debugging trick, I think it won't be necessary
most of the time but feel free to re-add it if you like.

To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to
More majordomo info at
Please read the FAQ at

 \ /
  Last update: 2005-03-22 13:25    [W:0.075 / U:3.084 seconds]
©2003-2018 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site