| From a626ca6a656450e9f4df91d0dda238fff23285f4 Mon Sep 17 00:00:00 2001 |
| From: Linus Torvalds <torvalds@linux-foundation.org> |
| Date: Wed, 13 Apr 2011 08:07:28 -0700 |
| Subject: vm: fix vm_pgoff wrap in stack expansion |
| MIME-Version: 1.0 |
| Content-Type: text/plain; charset=UTF-8 |
| Content-Transfer-Encoding: 8bit |
| |
| From: Linus Torvalds <torvalds@linux-foundation.org> |
| |
| commit a626ca6a656450e9f4df91d0dda238fff23285f4 upstream. |
| |
| Commit 982134ba6261 ("mm: avoid wrapping vm_pgoff in mremap()") fixed |
| the case of a expanding mapping causing vm_pgoff wrapping when you used |
| mremap. But there was another case where we expand mappings hiding in |
| plain sight: the automatic stack expansion. |
| |
| This fixes that case too. |
| |
| This one also found by Robert Święcki, using his nasty system call |
| fuzzer tool. Good job. |
| |
| Reported-and-tested-by: Robert Święcki <robert@swiecki.net> |
| Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org> |
| Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> |
| |
| --- |
| mm/mmap.c | 11 +++++++---- |
| 1 file changed, 7 insertions(+), 4 deletions(-) |
| |
| --- a/mm/mmap.c |
| +++ b/mm/mmap.c |
| @@ -1721,10 +1721,13 @@ static int expand_downwards(struct vm_ar |
| size = vma->vm_end - address; |
| grow = (vma->vm_start - address) >> PAGE_SHIFT; |
| |
| - error = acct_stack_growth(vma, size, grow); |
| - if (!error) { |
| - vma->vm_start = address; |
| - vma->vm_pgoff -= grow; |
| + error = -ENOMEM; |
| + if (grow <= vma->vm_pgoff) { |
| + error = acct_stack_growth(vma, size, grow); |
| + if (!error) { |
| + vma->vm_start = address; |
| + vma->vm_pgoff -= grow; |
| + } |
| } |
| } |
| anon_vma_unlock(vma); |