linux-kernel - [PATCH] tmpfs: fix VM_MAYSHARE mappings for NOMMU

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <20160422221944.GA14264@brightrain.aerifal.cx>
Date:	Fri, 22 Apr 2016 18:19:44 -0400
From:	Rich Felker <dalias@...c.org>
To:	linux-kernel@...r.kernel.org
Cc:	Michal Hocko <mhocko@...e.com>,
	Andrew Morton <akpm@...ux-foundation.org>,
	Greg Ungerer <gerg@...inux.org>,
	Geert Uytterhoeven <geert@...ux-m68k.org>,
	Yoshinori Sato <ysato@...rs.sourceforge.jp>
Subject: [PATCH] tmpfs: fix VM_MAYSHARE mappings for NOMMU

The nommu do_mmap expects f_op->get_unmapped_area to either succeed or
return -ENOSYS for VM_MAYSHARE (e.g. private read-only) mappings.
Returning addr in the non-MAP_SHARED case was completely wrong, and
only happened to work because addr was 0. However, it prevented
VM_MAYSHARE mappings from sharing backing with the fs cache, and
forced such mappings (including shareable program text) to be copied
whenever the number of mappings transitioned from 0 to 1, impacting
performance and memory usage. Subsequent mappings beyond the first
still correctly shared memory with the first.

Instead, treat VM_MAYSHARE identically to VM_SHARED at the file ops
level; do_mmap already handles the semantic differences between them.

Signed-off-by: Rich Felker <dalias@...c.org>
---
 fs/ramfs/file-nommu.c | 8 ++------
 1 file changed, 2 insertions(+), 6 deletions(-)

diff --git a/fs/ramfs/file-nommu.c b/fs/ramfs/file-nommu.c
index a586467..be3ddd1 100644
--- a/fs/ramfs/file-nommu.c
+++ b/fs/ramfs/file-nommu.c
@@ -211,14 +211,11 @@ static unsigned long ramfs_nommu_get_unmapped_area(struct file *file,
 	struct page **pages = NULL, **ptr, *page;
 	loff_t isize;

-	if (!(flags & MAP_SHARED))
-		return addr;
-
 	/* the mapping mustn't extend beyond the EOF */
 	lpages = (len + PAGE_SIZE - 1) >> PAGE_SHIFT;
 	isize = i_size_read(inode);

-	ret = -EINVAL;
+	ret = -ENOSYS;
 	maxpages = (isize + PAGE_SIZE - 1) >> PAGE_SHIFT;
 	if (pgoff >= maxpages)
 		goto out;
@@ -227,7 +224,6 @@ static unsigned long ramfs_nommu_get_unmapped_area(struct file *file,
 		goto out;

 	/* gang-find the pages */
-	ret = -ENOMEM;
 	pages = kcalloc(lpages, sizeof(struct page *), GFP_KERNEL);
 	if (!pages)
 		goto out_free;
@@ -263,7 +259,7 @@ out:
  */
 static int ramfs_nommu_mmap(struct file *file, struct vm_area_struct *vma)
 {
-	if (!(vma->vm_flags & VM_SHARED))
+	if (!(vma->vm_flags & (VM_SHARED | VM_MAYSHARE)))
 		return -ENOSYS;

 	file_accessed(file);
-- 
2.7.0