pagemap_read scans through the virtual address space of a task till it prepares 'count' pagemaps or it reaches end of task. This presents a problem when the page walk doesn't happen for vma with VM_PFNMAP set. In which case walk is silently skipped and no pagemap is prepare, in turn making pagemap_read to scan through task end, even crossing beyond 'count', landing into a different vma region. This leads to wrong presentation of mappings for that vma. Fix this by limiting end_vaddr to the end of the virtual address region being scanned. Signed-off-by: Shiraz Hashim <shashim@xxxxxxxxxxxxxx> --- fs/proc/task_mmu.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/fs/proc/task_mmu.c b/fs/proc/task_mmu.c index 246eae8..04362e4 100644 --- a/fs/proc/task_mmu.c +++ b/fs/proc/task_mmu.c @@ -1270,7 +1270,9 @@ static ssize_t pagemap_read(struct file *file, char __user *buf, src = *ppos; svpfn = src / PM_ENTRY_BYTES; start_vaddr = svpfn << PAGE_SHIFT; - end_vaddr = TASK_SIZE_OF(task); + end_vaddr = start_vaddr + ((count / PM_ENTRY_BYTES) << PAGE_SHIFT); + if ((end_vaddr > TASK_SIZE_OF(task)) || (end_vaddr < start_vaddr)) + end_vaddr = TASK_SIZE_OF(task); /* watch out for wraparound */ if (svpfn > TASK_SIZE_OF(task) >> PAGE_SHIFT) -- QUALCOMM INDIA, on behalf of Qualcomm Innovation Center, Inc. is a member of the Code Aurora Forum, hosted by The Linux Foundation -- To unsubscribe, send a message with 'unsubscribe linux-mm' in the body to majordomo@xxxxxxxxx. For more info on Linux MM, see: http://www.linux-mm.org/ . Don't email: <a href=mailto:"dont@xxxxxxxxx";> email@xxxxxxxxx </a>