Commit e0f81ab1 authored by Sebastian Ott's avatar Sebastian Ott Committed by Andrew Morton
Browse files

mm: fix vm_brk_flags() to not bail out while holding lock 

Calling vm_brk_flags() with flags set other than VM_EXEC will exit the
function without releasing the mmap_write_lock.

Just do the sanity check before the lock is acquired.  This doesn't fix an
actual issue since no caller sets a flag other than VM_EXEC.

Link: https://lkml.kernel.org/r/20230929171937.work.697-kees@kernel.org


Fixes: 2e7ce7d3 ("mm/mmap: change do_brk_flags() to expand existing VMA and add do_brk_munmap()")
Signed-off-by: default avatarSebastian Ott <sebott@redhat.com>
Signed-off-by: default avatarKees Cook <keescook@chromium.org>
Reviewed-by: default avatarLiam R. Howlett <Liam.Howlett@oracle.com>
Cc: Yu Zhao <yuzhao@google.com>
Signed-off-by: default avatarAndrew Morton <akpm@linux-foundation.org>
parent 51f62537

mm/mmap.c

+3 −3
Original line number Diff line number Diff line
@@ -3143,13 +3143,13 @@ int vm_brk_flags(unsigned long addr, unsigned long request, unsigned long flags) 
	if (!len)

		return 0;



	if (mmap_write_lock_killable(mm))

		return -EINTR;



	/* Until we need other flags, refuse anything except VM_EXEC. */

	if ((flags & (~VM_EXEC)) != 0)

		return -EINVAL;



	if (mmap_write_lock_killable(mm))

		return -EINTR;



	ret = check_brk_limits(addr, len);

	if (ret)

		goto limits_failed;