From e92b05dec8865619ea2608c5c11a54b01467482f Mon Sep 17 00:00:00 2001 From: Linus Torvalds Date: Fri, 24 Sep 2010 14:13:57 -0700 Subject: fremap: get rid of broken 'end' variable Thomas Pollet points out that the 'end' variable is broken. It was computed based on start/size before they were page-aligned, and as such doesn't actually match any of the other actions we take. The overflow test on end was also redundant, since we had already tested it with the properly aligned version. So just get rid of it entirely. The one remaining use for that broken variable can just use 'start+size' like all the other cases already did. Reported-by: Thomas Pollet Signed-off-by: Linus Torvalds --- mm/fremap.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) (limited to 'mm/fremap.c') diff --git a/mm/fremap.c b/mm/fremap.c index 46f5dacf90a..7b7f852848d 100644 --- a/mm/fremap.c +++ b/mm/fremap.c @@ -125,7 +125,6 @@ SYSCALL_DEFINE5(remap_file_pages, unsigned long, start, unsigned long, size, { struct mm_struct *mm = current->mm; struct address_space *mapping; - unsigned long end = start + size; struct vm_area_struct *vma; int err = -EINVAL; int has_write_lock = 0; @@ -168,7 +167,7 @@ SYSCALL_DEFINE5(remap_file_pages, unsigned long, start, unsigned long, size, if (!(vma->vm_flags & VM_CAN_NONLINEAR)) goto out; - if (end <= start || start < vma->vm_start || end > vma->vm_end) + if (start < vma->vm_start || start + size > vma->vm_end) goto out; /* Must set VM_NONLINEAR before any pages are populated. */ -- cgit v1.2.3-70-g09d2 From 5ec1055aa5632dd7a8283cdb5fa9be3c535eaa06 Mon Sep 17 00:00:00 2001 From: Larry Woodman Date: Fri, 24 Sep 2010 12:04:48 -0400 Subject: Avoid pgoff overflow in remap_file_pages Thomas Pollet noticed that the remap_file_pages() system call in fremap.c has a potential overflow in the first part of the if statement below, which could cause it to process bogus input parameters. Specifically the pgoff + size parameters could be wrap thereby preventing the system call from failing when it should. Reported-by: Thomas Pollet Signed-off-by: Larry Woodman Signed-off-by: Linus Torvalds --- mm/fremap.c | 4 ++++ 1 file changed, 4 insertions(+) (limited to 'mm/fremap.c') diff --git a/mm/fremap.c b/mm/fremap.c index 7b7f852848d..ec520c7b28d 100644 --- a/mm/fremap.c +++ b/mm/fremap.c @@ -141,6 +141,10 @@ SYSCALL_DEFINE5(remap_file_pages, unsigned long, start, unsigned long, size, if (start + size <= start) return err; + /* Does pgoff wrap? */ + if (pgoff + (size >> PAGE_SHIFT) < pgoff) + return err; + /* Can we represent this offset inside this architecture's pte's? */ #if PTE_FILE_MAX_BITS < BITS_PER_LONG if (pgoff + (size >> PAGE_SHIFT) >= (1UL << PTE_FILE_MAX_BITS)) -- cgit v1.2.3-70-g09d2