In most cases, the range of the area is valid. But in do_mprotect_pkey(), the minimum value of end and vma->vm_end is passed to mprotect_fixup(). This will lead to the end is less than the end of prev. In this case, the curr will be NULL, but the next will be equal to the prev. So it will attempt to merge before, the vm_pgoff check will cause this case to fail. To avoid the process described above and reduce unnecessary operations. Add a check to immediately return NULL if the end is less than the end of prev. Signed-off-by: Yajun Deng <yajun.deng@xxxxxxxxx> --- v2: remove the case label. v1: https://lore.kernel.org/all/20240218085028.3294332-1-yajun.deng@xxxxxxxxx/ --- mm/mmap.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/mm/mmap.c b/mm/mmap.c index 0fccd23f056e..7668854d2246 100644 --- a/mm/mmap.c +++ b/mm/mmap.c @@ -890,6 +890,9 @@ static struct vm_area_struct if (vm_flags & VM_SPECIAL) return NULL; + if (prev && end < prev->vm_end) + return NULL; + /* Does the input range span an existing VMA? (cases 5 - 8) */ curr = find_vma_intersection(mm, prev ? prev->vm_end : 0, end); -- 2.25.1
