mirror of
https://github.com/FEX-Emu/linux.git
synced 2025-01-17 23:15:52 +00:00
mm: fix regression in remap_file_pages() emulation
Grazvydas Ignotas has reported a regression in remap_file_pages() emulation. Testcase: #define _GNU_SOURCE #include <assert.h> #include <stdlib.h> #include <stdio.h> #include <sys/mman.h> #define SIZE (4096 * 3) int main(int argc, char **argv) { unsigned long *p; long i; p = mmap(NULL, SIZE, PROT_READ | PROT_WRITE, MAP_SHARED | MAP_ANONYMOUS, -1, 0); if (p == MAP_FAILED) { perror("mmap"); return -1; } for (i = 0; i < SIZE / 4096; i++) p[i * 4096 / sizeof(*p)] = i; if (remap_file_pages(p, 4096, 0, 1, 0)) { perror("remap_file_pages"); return -1; } if (remap_file_pages(p, 4096 * 2, 0, 1, 0)) { perror("remap_file_pages"); return -1; } assert(p[0] == 1); munmap(p, SIZE); return 0; } The second remap_file_pages() fails with -EINVAL. The reason is that remap_file_pages() emulation assumes that the target vma covers whole area we want to over map. That assumption is broken by first remap_file_pages() call: it split the area into two vma. The solution is to check next adjacent vmas, if they map the same file with the same flags. Fixes: c8d78c1823f4 ("mm: replace remap_file_pages() syscall with emulation") Signed-off-by: Kirill A. Shutemov <kirill.shutemov@linux.intel.com> Reported-by: Grazvydas Ignotas <notasas@gmail.com> Tested-by: Grazvydas Ignotas <notasas@gmail.com> Cc: <stable@vger.kernel.org> [4.0+] Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
This commit is contained in:
parent
69a8ec2d81
commit
48f7df3294
34
mm/mmap.c
34
mm/mmap.c
@ -2664,12 +2664,29 @@ SYSCALL_DEFINE5(remap_file_pages, unsigned long, start, unsigned long, size,
|
||||
if (!vma || !(vma->vm_flags & VM_SHARED))
|
||||
goto out;
|
||||
|
||||
if (start < vma->vm_start || start + size > vma->vm_end)
|
||||
if (start < vma->vm_start)
|
||||
goto out;
|
||||
|
||||
if (pgoff == linear_page_index(vma, start)) {
|
||||
ret = 0;
|
||||
goto out;
|
||||
if (start + size > vma->vm_end) {
|
||||
struct vm_area_struct *next;
|
||||
|
||||
for (next = vma->vm_next; next; next = next->vm_next) {
|
||||
/* hole between vmas ? */
|
||||
if (next->vm_start != next->vm_prev->vm_end)
|
||||
goto out;
|
||||
|
||||
if (next->vm_file != vma->vm_file)
|
||||
goto out;
|
||||
|
||||
if (next->vm_flags != vma->vm_flags)
|
||||
goto out;
|
||||
|
||||
if (start + size <= next->vm_end)
|
||||
break;
|
||||
}
|
||||
|
||||
if (!next)
|
||||
goto out;
|
||||
}
|
||||
|
||||
prot |= vma->vm_flags & VM_READ ? PROT_READ : 0;
|
||||
@ -2679,9 +2696,16 @@ SYSCALL_DEFINE5(remap_file_pages, unsigned long, start, unsigned long, size,
|
||||
flags &= MAP_NONBLOCK;
|
||||
flags |= MAP_SHARED | MAP_FIXED | MAP_POPULATE;
|
||||
if (vma->vm_flags & VM_LOCKED) {
|
||||
struct vm_area_struct *tmp;
|
||||
flags |= MAP_LOCKED;
|
||||
|
||||
/* drop PG_Mlocked flag for over-mapped range */
|
||||
munlock_vma_pages_range(vma, start, start + size);
|
||||
for (tmp = vma; tmp->vm_start >= start + size;
|
||||
tmp = tmp->vm_next) {
|
||||
munlock_vma_pages_range(tmp,
|
||||
max(tmp->vm_start, start),
|
||||
min(tmp->vm_end, start + size));
|
||||
}
|
||||
}
|
||||
|
||||
file = get_file(vma->vm_file);
|
||||
|
Loading…
x
Reference in New Issue
Block a user