The patch titled
Handle wrapping in expand_upwards()
has been added to the -mm tree. Its filename is
handle-wrapping-in-expand_upwards.patch
*** Remember to use Documentation/SubmitChecklist when testing your code ***
See http://www.zip.com.au/~akpm/linux/patches/stuff/added-to-mm.txt to find
out what to do about this
------------------------------------------------------
Subject: Handle wrapping in expand_upwards()
From: Helge Deller <deller@xxxxxx>
Function expand_upwards() did not guarded against wrapping around to
address 0. This fixes the adjtimex02 testcase from the Linux Test Project
on a 32bit PARISC kernel.
Signed-off-by: Helge Deller <deller@xxxxxx>
Cc: Tony Luck <tony.luck@xxxxxxxxx>
Signed-off-by: Kyle McMartin <kyle@xxxxxxxxxxxxxxxx>
Signed-off-by: Andrew Morton <akpm@xxxxxxxxxxxxxxxxxxxx>
---
mm/mmap.c | 9 +++++++--
1 file changed, 7 insertions(+), 2 deletions(-)
diff -puN mm/mmap.c~handle-wrapping-in-expand_upwards mm/mmap.c
--- a/mm/mmap.c~handle-wrapping-in-expand_upwards
+++ a/mm/mmap.c
@@ -1536,9 +1536,14 @@ int expand_upwards(struct vm_area_struct
* vma->vm_start/vm_end cannot change under us because the caller
* is required to hold the mmap_sem in read mode. We need the
* anon_vma lock to serialize against concurrent expand_stacks.
+ * Also guard against wrapping around to address 0.
*/
- address += 4 + PAGE_SIZE - 1;
- address &= PAGE_MASK;
+ if (address < PAGE_ALIGN(address+4))
+ address = PAGE_ALIGN(address+4);
+ else {
+ anon_vma_unlock(vma);
+ return -ENOMEM;
+ }
error = 0;
/* Somebody else might have raced and expanded it already */
_
Patches currently in -mm which might be from deller@xxxxxx are
handle-wrapping-in-expand_upwards.patch
-
To unsubscribe from this list: send the line "unsubscribe mm-commits" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at http://vger.kernel.org/majordomo-info.html
