linux-kernel - Re: [PATCH] mmap_region: cleanup, remove unneeded file != NULL check

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <Pine.LNX.4.64.0802062013210.32204@blonde.site>
Date:	Wed, 6 Feb 2008 20:22:31 +0000 (GMT)
From:	Hugh Dickins <hugh@...itas.com>
To:	Oleg Nesterov <oleg@...sign.ru>
cc:	Andrew Morton <akpm@...ux-foundation.org>,
	Miklos Szeredi <mszeredi@...e.cz>, linux-kernel@...r.kernel.org
Subject: Re: [PATCH] mmap_region: cleanup, remove unneeded file != NULL check

On Sun, 3 Feb 2008, Oleg Nesterov wrote:

> mmap_region() checks "file != NULL" when we know "file && vma_merge() == T".
> Also, swap these if/else branches, imho make the code a bit more readable.
> 
> Signed-off-by: Oleg Nesterov <oleg@...sign.ru>

Acked-with-a-but-by: Hugh Dickins <hugh@...itas.com>

That's a great little improvement, Oleg: my difficulty in understanding
the patch is all due to the obscurity of the original you're improving.

But my but is this: you can go one step further, it's silly to be
repeating the "if (correct_wcount) atomic_inc..." in both the if
and the else clauses.

For several minutes I thought that must indicate we already had a
bug there.  Eventually I realized not: we need deny_write_access()
above to test and deny atomically, then once we've merged or linked
the vma it's securely denying in the vma itself: so before returning
we need to undo our temporary denial.  A brief comment might be
worthwhile, perhaps something like

	/* Once vma denies write, undo our temporary denial count */
	if (correct_wcount)
		atomic_inc(&inode->i_writecount);

Hugh

> 
> --- MM/mm/mmap.c~1_MMAP	2008-01-27 17:09:47.000000000 +0300
> +++ MM/mm/mmap.c	2008-02-03 20:49:39.000000000 +0300
> @@ -1189,22 +1189,20 @@ munmap_back:
>  	if (vma_wants_writenotify(vma))
>  		vma->vm_page_prot = vm_get_page_prot(vm_flags & ~VM_SHARED);
>  
> -	if (!file || !vma_merge(mm, prev, addr, vma->vm_end,
> +	if (file && vma_merge(mm, prev, addr, vma->vm_end,
>  			vma->vm_flags, NULL, file, pgoff, vma_policy(vma))) {
> +		mpol_free(vma_policy(vma));
> +		kmem_cache_free(vm_area_cachep, vma);
> +		if (correct_wcount)
> +			atomic_inc(&inode->i_writecount);
> +		fput(file);
> +	} else {
>  		file = vma->vm_file;
>  		vma_link(mm, vma, prev, rb_link, rb_parent);
>  		if (correct_wcount)
>  			atomic_inc(&inode->i_writecount);
> -	} else {
> -		if (file) {
> -			if (correct_wcount)
> -				atomic_inc(&inode->i_writecount);
> -			fput(file);
> -		}
> -		mpol_free(vma_policy(vma));
> -		kmem_cache_free(vm_area_cachep, vma);
>  	}
> -out:	
> +out:
>  	mm->total_vm += len >> PAGE_SHIFT;
>  	vm_stat_account(mm, vm_flags, file, len >> PAGE_SHIFT);
>  	if (vm_flags & VM_LOCKED) {
> 
> --
> To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
> the body of a message to majordomo@...r.kernel.org
> More majordomo info at  http://vger.kernel.org/majordomo-info.html
> Please read the FAQ at  http://www.tux.org/lkml/
> 
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/