arch_get_unmapped_area() and arch_get_unmapped_area_topdown() could
potentially allow a larger than possible length when using the MAP_FIXED
flag. The bound check should come before the check for MAP_FIXED.
Fixes: ca56c8ee6fa0 (v2.4.3.2 -> v2.4.3.3)
Signed-off-by: Liam R. Howlett <Liam.Howlett@xxxxxxxxxx>
---
arch/sparc/kernel/sys_sparc_64.c | 16 ++++++++--------
1 file changed, 8 insertions(+), 8 deletions(-)
diff --git a/arch/sparc/kernel/sys_sparc_64.c b/arch/sparc/kernel/sys_sparc_64.c
index 1e9a9e016237..4ca7f9c18c54 100644
--- a/arch/sparc/kernel/sys_sparc_64.c
+++ b/arch/sparc/kernel/sys_sparc_64.c
@@ -95,6 +95,11 @@ unsigned long arch_get_unmapped_area(struct file *filp, unsigned long addr, unsi
int do_color_align;
struct vm_unmapped_area_info info;
+ if (test_thread_flag(TIF_32BIT))
+ task_size = STACK_TOP32;
+ if (unlikely(len > task_size || len >= VA_EXCLUDE_START))
+ return -ENOMEM;
+
if (flags & MAP_FIXED) {
/* We do not accept a shared mapping if it would violate
* cache aliasing constraints.
@@ -105,11 +110,6 @@ unsigned long arch_get_unmapped_area(struct file *filp, unsigned long addr, unsi
return addr;
}
- if (test_thread_flag(TIF_32BIT))
- task_size = STACK_TOP32;
- if (unlikely(len > task_size || len >= VA_EXCLUDE_START))
- return -ENOMEM;
-
do_color_align = 0;
if (filp || (flags & MAP_SHARED))
do_color_align = 1;
@@ -159,6 +159,9 @@ arch_get_unmapped_area_topdown(struct file *filp, const unsigned long addr0,
/* This should only ever run for 32-bit processes. */
BUG_ON(!test_thread_flag(TIF_32BIT));
+ if (unlikely(len > task_size))
+ return -ENOMEM;
+
if (flags & MAP_FIXED) {
/* We do not accept a shared mapping if it would violate
* cache aliasing constraints.
@@ -169,9 +172,6 @@ arch_get_unmapped_area_topdown(struct file *filp, const unsigned long addr0,
return addr;
}
- if (unlikely(len > task_size))
- return -ENOMEM;
-
do_color_align = 0;
if (filp || (flags & MAP_SHARED))
do_color_align = 1;
--
2.30.2
