The patch titled Subject: mm: madvise: complete input validation before taking lock has been added to the -mm tree. Its filename is mm-madvise-complete-input-validation-before-taking-lock.patch Before you just go and hit "reply", please: a) Consider who else should be cc'ed b) Prefer to cc a suitable mailing list as well c) Ideally: find the original patch on the mailing list and do a reply-to-all to that, adding suitable additional cc's *** Remember to use Documentation/SubmitChecklist when testing your code *** The -mm tree is included into linux-next and is updated there every 3-4 working days ------------------------------------------------------ From: Rasmus Villemoes <linux@xxxxxxxxxxxxxxxxxx> Subject: mm: madvise: complete input validation before taking lock In madvise(), there doesn't seem to be any reason for taking the ¤t->mm->mmap_sem before start and len_in have been validated. Incidentally, this removes the need for the out: label. Signed-off-by: Rasmus Villemoes <linux@xxxxxxxxxxxxxxxxxx> Signed-off-by: Andrew Morton <akpm@xxxxxxxxxxxxxxxxxxxx> --- mm/madvise.c | 21 ++++++++++----------- 1 file changed, 10 insertions(+), 11 deletions(-) diff -puN mm/madvise.c~mm-madvise-complete-input-validation-before-taking-lock mm/madvise.c --- a/mm/madvise.c~mm-madvise-complete-input-validation-before-taking-lock +++ a/mm/madvise.c @@ -473,27 +473,27 @@ SYSCALL_DEFINE3(madvise, unsigned long, if (!madvise_behavior_valid(behavior)) return error; - write = madvise_need_mmap_write(behavior); - if (write) - down_write(¤t->mm->mmap_sem); - else - down_read(¤t->mm->mmap_sem); - if (start & ~PAGE_MASK) - goto out; + return error; len = (len_in + ~PAGE_MASK) & PAGE_MASK; /* Check to see whether len was rounded up from small -ve to zero */ if (len_in && !len) - goto out; + return error; end = start + len; if (end < start) - goto out; + return error; error = 0; if (end == start) - goto out; + return error; + + write = madvise_need_mmap_write(behavior); + if (write) + down_write(¤t->mm->mmap_sem); + else + down_read(¤t->mm->mmap_sem); /* * If the interval [start,end) covers some unmapped address @@ -541,7 +541,6 @@ SYSCALL_DEFINE3(madvise, unsigned long, } out_plug: blk_finish_plug(&plug); -out: if (write) up_write(¤t->mm->mmap_sem); else _ Patches currently in -mm which might be from linux@xxxxxxxxxxxxxxxxxx are mm-madvise-complete-input-validation-before-taking-lock.patch -- To unsubscribe from this list: send the line "unsubscribe mm-commits" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html