Skip to content

Commit 94d149c

Browse files
davem330davem330
committed
sparc: Fix mremap address range validation.
Just like mmap, we need to validate address ranges regardless of MAP_FIXED. sparc{,64}_mmap_check()'s flag argument is unused, remove. Based upon a report and preliminary patch by Jan Lieskovsky <jlieskov@redhat.com> Signed-off-by: David S. Miller <davem@davemloft.net>
1 parent c714a53 commit 94d149c

File tree

5 files changed

+15
-112
lines changed

5 files changed

+15
-112
lines changed

‎arch/sparc/kernel/sys_sparc.c

Lines changed: 5 additions & 43 deletions
Original file line numberDiff line numberDiff line change
@@ -219,7 +219,7 @@ asmlinkage int sys_ipc (uint call, int first, int second, int third, void __user
219219
return err;
220220
}
221221

222-
int sparc_mmap_check(unsigned long addr, unsigned long len, unsigned long flags)
222+
int sparc_mmap_check(unsigned long addr, unsigned long len)
223223
{
224224
if (ARCH_SUN4C_SUN4 &&
225225
(len > 0x20000000 ||
@@ -295,52 +295,14 @@ asmlinkage unsigned long sparc_mremap(unsigned long addr,
295295
unsigned long old_len, unsigned long new_len,
296296
unsigned long flags, unsigned long new_addr)
297297
{
298-
struct vm_area_struct *vma;
299298
unsigned long ret = -EINVAL;
300-
if (ARCH_SUN4C_SUN4) {
301-
if (old_len > 0x20000000 || new_len > 0x20000000)
302-
goto out;
303-
if (addr < 0xe0000000 && addr + old_len > 0x20000000)
304-
goto out;
305-
}
306-
if (old_len > TASK_SIZE - PAGE_SIZE ||
307-
new_len > TASK_SIZE - PAGE_SIZE)
299+
300+
if (unlikely(sparc_mmap_check(addr, old_len)))
301+
goto out;
302+
if (unlikely(sparc_mmap_check(new_addr, new_len)))
308303
goto out;
309304
down_write(&current->mm->mmap_sem);
310-
if (flags & MREMAP_FIXED) {
311-
if (ARCH_SUN4C_SUN4 &&
312-
new_addr < 0xe0000000 &&
313-
new_addr + new_len > 0x20000000)
314-
goto out_sem;
315-
if (new_addr + new_len > TASK_SIZE - PAGE_SIZE)
316-
goto out_sem;
317-
} else if ((ARCH_SUN4C_SUN4 && addr < 0xe0000000 &&
318-
addr + new_len > 0x20000000) ||
319-
addr + new_len > TASK_SIZE - PAGE_SIZE) {
320-
unsigned long map_flags = 0;
321-
struct file *file = NULL;
322-
323-
ret = -ENOMEM;
324-
if (!(flags & MREMAP_MAYMOVE))
325-
goto out_sem;
326-
327-
vma = find_vma(current->mm, addr);
328-
if (vma) {
329-
if (vma->vm_flags & VM_SHARED)
330-
map_flags |= MAP_SHARED;
331-
file = vma->vm_file;
332-
}
333-
334-
new_addr = get_unmapped_area(file, addr, new_len,
335-
vma ? vma->vm_pgoff : 0,
336-
map_flags);
337-
ret = new_addr;
338-
if (new_addr & ~PAGE_MASK)
339-
goto out_sem;
340-
flags |= MREMAP_FIXED;
341-
}
342305
ret = do_mremap(addr, old_len, new_len, flags, new_addr);
343-
out_sem:
344306
up_write(&current->mm->mmap_sem);
345307
out:
346308
return ret;

‎arch/sparc64/kernel/sys_sparc.c

Lines changed: 4 additions & 32 deletions
Original file line numberDiff line numberDiff line change
@@ -542,8 +542,7 @@ asmlinkage long sparc64_personality(unsigned long personality)
542542
return ret;
543543
}
544544

545-
int sparc64_mmap_check(unsigned long addr, unsigned long len,
546-
unsigned long flags)
545+
int sparc64_mmap_check(unsigned long addr, unsigned long len)
547546
{
548547
if (test_thread_flag(TIF_32BIT)) {
549548
if (len >= STACK_TOP32)
@@ -609,46 +608,19 @@ asmlinkage unsigned long sys64_mremap(unsigned long addr,
609608
unsigned long old_len, unsigned long new_len,
610609
unsigned long flags, unsigned long new_addr)
611610
{
612-
struct vm_area_struct *vma;
613611
unsigned long ret = -EINVAL;
614612

615613
if (test_thread_flag(TIF_32BIT))
616614
goto out;
617615
if (unlikely(new_len >= VA_EXCLUDE_START))
618616
goto out;
619-
if (unlikely(invalid_64bit_range(addr, old_len)))
617+
if (unlikely(sparc64_mmap_check(addr, old_len)))
618+
goto out;
619+
if (unlikely(sparc64_mmap_check(new_addr, new_len)))
620620
goto out;
621621

622622
down_write(&current->mm->mmap_sem);
623-
if (flags & MREMAP_FIXED) {
624-
if (invalid_64bit_range(new_addr, new_len))
625-
goto out_sem;
626-
} else if (invalid_64bit_range(addr, new_len)) {
627-
unsigned long map_flags = 0;
628-
struct file *file = NULL;
629-
630-
ret = -ENOMEM;
631-
if (!(flags & MREMAP_MAYMOVE))
632-
goto out_sem;
633-
634-
vma = find_vma(current->mm, addr);
635-
if (vma) {
636-
if (vma->vm_flags & VM_SHARED)
637-
map_flags |= MAP_SHARED;
638-
file = vma->vm_file;
639-
}
640-
641-
/* MREMAP_FIXED checked above. */
642-
new_addr = get_unmapped_area(file, addr, new_len,
643-
vma ? vma->vm_pgoff : 0,
644-
map_flags);
645-
ret = new_addr;
646-
if (new_addr & ~PAGE_MASK)
647-
goto out_sem;
648-
flags |= MREMAP_FIXED;
649-
}
650623
ret = do_mremap(addr, old_len, new_len, flags, new_addr);
651-
out_sem:
652624
up_write(&current->mm->mmap_sem);
653625
out:
654626
return ret;

‎arch/sparc64/kernel/sys_sparc32.c

Lines changed: 2 additions & 31 deletions
Original file line numberDiff line numberDiff line change
@@ -867,44 +867,15 @@ asmlinkage unsigned long sys32_mremap(unsigned long addr,
867867
unsigned long old_len, unsigned long new_len,
868868
unsigned long flags, u32 __new_addr)
869869
{
870-
struct vm_area_struct *vma;
871870
unsigned long ret = -EINVAL;
872871
unsigned long new_addr = __new_addr;
873872

874-
if (old_len > STACK_TOP32 || new_len > STACK_TOP32)
873+
if (unlikely(sparc64_mmap_check(addr, old_len)))
875874
goto out;
876-
if (addr > STACK_TOP32 - old_len)
875+
if (unlikely(sparc64_mmap_check(new_addr, new_len)))
877876
goto out;
878877
down_write(&current->mm->mmap_sem);
879-
if (flags & MREMAP_FIXED) {
880-
if (new_addr > STACK_TOP32 - new_len)
881-
goto out_sem;
882-
} else if (addr > STACK_TOP32 - new_len) {
883-
unsigned long map_flags = 0;
884-
struct file *file = NULL;
885-
886-
ret = -ENOMEM;
887-
if (!(flags & MREMAP_MAYMOVE))
888-
goto out_sem;
889-
890-
vma = find_vma(current->mm, addr);
891-
if (vma) {
892-
if (vma->vm_flags & VM_SHARED)
893-
map_flags |= MAP_SHARED;
894-
file = vma->vm_file;
895-
}
896-
897-
/* MREMAP_FIXED checked above. */
898-
new_addr = get_unmapped_area(file, addr, new_len,
899-
vma ? vma->vm_pgoff : 0,
900-
map_flags);
901-
ret = new_addr;
902-
if (new_addr & ~PAGE_MASK)
903-
goto out_sem;
904-
flags |= MREMAP_FIXED;
905-
}
906878
ret = do_mremap(addr, old_len, new_len, flags, new_addr);
907-
out_sem:
908879
up_write(&current->mm->mmap_sem);
909880
out:
910881
return ret;

‎include/asm-sparc/mman.h

Lines changed: 2 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -24,9 +24,8 @@
2424

2525
#ifdef __KERNEL__
2626
#ifndef __ASSEMBLY__
27-
#define arch_mmap_check sparc_mmap_check
28-
int sparc_mmap_check(unsigned long addr, unsigned long len,
29-
unsigned long flags);
27+
#define arch_mmap_check(addr,len,flags) sparc_mmap_check(addr,len)
28+
int sparc_mmap_check(unsigned long addr, unsigned long len);
3029
#endif
3130
#endif
3231

‎include/asm-sparc64/mman.h

Lines changed: 2 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -24,9 +24,8 @@
2424

2525
#ifdef __KERNEL__
2626
#ifndef __ASSEMBLY__
27-
#define arch_mmap_check sparc64_mmap_check
28-
int sparc64_mmap_check(unsigned long addr, unsigned long len,
29-
unsigned long flags);
27+
#define arch_mmap_check(addr,len,flags) sparc64_mmap_check(addr,len)
28+
int sparc64_mmap_check(unsigned long addr, unsigned long len);
3029
#endif
3130
#endif
3231

0 commit comments

Comments
 (0)