linux-kernel - Re: [PATCH] sys_remap_file_pages: fix ->vm

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Wed, 30 Jan 2008 17:55:01 +0100
From:	Miklos Szeredi <mszeredi@...e.cz>
To:	Oleg Nesterov <oleg@...sign.ru>
Cc:	Andrew Morton <akpm@...ux-foundation.org>,
	Peter Zijlstra <a.p.zijlstra@...llo.nl>,
	William Lee Irwin III <wli@...omorphy.com>,
	Nick Piggin <nickpiggin@...oo.com.au>,
	Ingo Molnar <mingo@...e.hu>, linux-kernel@...r.kernel.org,
	stable@...nel.org
Subject: Re: [PATCH] sys_remap_file_pages: fix ->vm_file accounting


On Wed, 2008-01-30 at 17:20 +0300, Oleg Nesterov wrote:
> Fix ->vm_file accounting, mmap_region() may do do_munmap().

Ouch!  I didn't think of that case at all...

There's a small problem with the patch: the vma itself is freed at
unmap, so the fput(vma->vm_file) may crash.  Here's an updated patch.

Thanks for spotting this!

Miklos
----


From: Oleg Nesterov <oleg@...sign.ru>

Fix ->vm_file accounting, mmap_region() may do do_munmap().

Signed-off-by: Oleg Nesterov <oleg@...sign.ru>
Signed-off-by: Miklos Szeredi <mszeredi@...e.cz>
---

Index: linux/mm/fremap.c
===================================================================
--- linux.orig/mm/fremap.c	2008-01-17 19:00:17.000000000 +0100
+++ linux/mm/fremap.c	2008-01-30 17:47:27.000000000 +0100
@@ -190,10 +190,13 @@ asmlinkage long sys_remap_file_pages(uns
 		 */
 		if (mapping_cap_account_dirty(mapping)) {
 			unsigned long addr;
+			struct file *file = vma->vm_file;
 
 			flags &= MAP_NONBLOCK;
-			addr = mmap_region(vma->vm_file, start, size,
+			get_file(file);
+			addr = mmap_region(file, start, size,
 					flags, vma->vm_flags, pgoff, 1);
+			fput(file);
 			if (IS_ERR_VALUE(addr)) {
 				err = addr;
 			} else {


--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/