Commit 07ab67c8 authored by Linus Torvalds's avatar Linus Torvalds
Browse files

Fix get_unmapped_area sanity tests 

As noted by Chris Wright, we need to do the full range of tests regardless
of whether MAP_FIXED is set or not, so re-organize get_unmapped_area()
slightly to do the sanity checks unconditionally.
parent 66e60f92

include/linux/err.h

+3 −1
Original line number Diff line number Diff line
@@ -13,6 +13,8 @@ 
 * This should be a per-architecture thing, to allow different

 * error and pointer decisions.

 */

#define IS_ERR_VALUE(x) unlikely((x) > (unsigned long)-1000L)



static inline void *ERR_PTR(long error)

{

	return (void *) error;
@@ -25,7 +27,7 @@ static inline long PTR_ERR(const void *ptr) 


static inline long IS_ERR(const void *ptr)

{

	return unlikely((unsigned long)ptr > (unsigned long)-1000L);

	return IS_ERR_VALUE((unsigned long)ptr);

}



#endif /* _LINUX_ERR_H */

mm/mmap.c

+31 −28
Original line number Diff line number Diff line
@@ -1302,9 +1302,19 @@ unsigned long 
get_unmapped_area(struct file *file, unsigned long addr, unsigned long len,

		unsigned long pgoff, unsigned long flags)

{

	if (flags & MAP_FIXED) {

	unsigned long ret;



	if (!(flags & MAP_FIXED)) {

		unsigned long (*get_area)(struct file *, unsigned long, unsigned long, unsigned long, unsigned long);



		get_area = current->mm->get_unmapped_area;

		if (file && file->f_op && file->f_op->get_unmapped_area)

			get_area = file->f_op->get_unmapped_area;

		addr = get_area(file, addr, len, pgoff, flags);

		if (IS_ERR_VALUE(addr))

			return addr;

	}



	if (addr > TASK_SIZE - len)

		return -ENOMEM;

	if (addr & ~PAGE_MASK)
@@ -1328,13 +1338,6 @@ get_unmapped_area(struct file *file, unsigned long addr, unsigned long len, 
	return addr;

}



	if (file && file->f_op && file->f_op->get_unmapped_area)

		return file->f_op->get_unmapped_area(file, addr, len,

						pgoff, flags);



	return current->mm->get_unmapped_area(file, addr, len, pgoff, flags);

}



EXPORT_SYMBOL(get_unmapped_area);



/* Look up the first VMA which satisfies  addr < vm_end,  NULL if none. */