lkml.org 
[lkml]   [2012]   [Aug]   [15]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[v2.6.34-stable 004/165] vm: fix vm_pgoff wrap in stack expansion
    Date
    From: Linus Torvalds <torvalds@linux-foundation.org>

    -------------------
    This is a commit scheduled for the next v2.6.34 longterm release.
    http://git.kernel.org/?p=linux/kernel/git/paulg/longterm-queue-2.6.34.git
    If you see a problem with using this for longterm, please comment.
    -------------------

    commit a626ca6a656450e9f4df91d0dda238fff23285f4 upstream.

    Commit 982134ba6261 ("mm: avoid wrapping vm_pgoff in mremap()") fixed
    the case of a expanding mapping causing vm_pgoff wrapping when you used
    mremap. But there was another case where we expand mappings hiding in
    plain sight: the automatic stack expansion.

    This fixes that case too.

    This one also found by Robert Święcki, using his nasty system call
    fuzzer tool. Good job.

    Reported-and-tested-by: Robert Święcki <robert@swiecki.net>
    Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
    [PG: .34 doesn't have perf call via 3af9e859 (in .36); adjust accordingly]
    Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
    ---
    mm/mmap.c | 11 +++++++----
    1 file changed, 7 insertions(+), 4 deletions(-)

    diff --git a/mm/mmap.c b/mm/mmap.c
    index b42b469..fe9b76a 100644
    --- a/mm/mmap.c
    +++ b/mm/mmap.c
    @@ -1784,10 +1784,13 @@ static int expand_downwards(struct vm_area_struct *vma,
    size = vma->vm_end - address;
    grow = (vma->vm_start - address) >> PAGE_SHIFT;

    - error = acct_stack_growth(vma, size, grow);
    - if (!error) {
    - vma->vm_start = address;
    - vma->vm_pgoff -= grow;
    + error = -ENOMEM;
    + if (grow <= vma->vm_pgoff) {
    + error = acct_stack_growth(vma, size, grow);
    + if (!error) {
    + vma->vm_start = address;
    + vma->vm_pgoff -= grow;
    + }
    }
    }
    anon_vma_unlock(vma);
    --
    1.7.12.rc2
    --
    To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
    the body of a message to majordomo@vger.kernel.org
    More majordomo info at http://vger.kernel.org/majordomo-info.html
    Please read the FAQ at http://www.tux.org/lkml/

    \
     
     \ /
      Last update: 2012-08-15 23:22    [W:4.157 / U:0.084 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site