* Yajun Deng <yajun.deng@xxxxxxxxx> [240221 04:15]: > In most cases, the range of the area is valid. But in do_mprotect_pkey(), > the minimum value of end and vma->vm_end is passed to mprotect_fixup(). > This will lead to the end is less than the end of prev. > > In this case, the curr will be NULL, but the next will be equal to the > prev. So it will attempt to merge before, the vm_pgoff check will cause > this case to fail. > > To avoid the process described above and reduce unnecessary operations. > Add a check to immediately return NULL if the end is less than the end of > prev. If it's only one caller, could we stop that caller instead of checking an almost never case for all callers? Would this better fit in vma_modify()? Although that's not just for this caller at this point. Maybe there isn't a good place? Or are there other reasons this may happen and is better done in this function? Often, this is called the "punch a hole" scenario; where an operation creates two entries from the old data and either leaves an empty space or fills the space with a new VMA. > > Signed-off-by: Yajun Deng <yajun.deng@xxxxxxxxx> > --- > v2: remove the case label. > v1: https://lore.kernel.org/all/20240218085028.3294332-1-yajun.deng@xxxxxxxxx/ > --- > mm/mmap.c | 3 +++ > 1 file changed, 3 insertions(+) > > diff --git a/mm/mmap.c b/mm/mmap.c > index 0fccd23f056e..7668854d2246 100644 > --- a/mm/mmap.c > +++ b/mm/mmap.c > @@ -890,6 +890,9 @@ static struct vm_area_struct > if (vm_flags & VM_SPECIAL) > return NULL; > > + if (prev && end < prev->vm_end) > + return NULL; > + > /* Does the input range span an existing VMA? (cases 5 - 8) */ > curr = find_vma_intersection(mm, prev ? prev->vm_end : 0, end); > > -- > 2.25.1 >
