linux-kernel - [PATCH] mm: fix align-error when get_addr in unmapped_area

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Date:   Tue, 12 Apr 2022 16:10:14 +0800
From:   lipeifeng@...o.com
To:     akpm@...ux-foundation.org, michel@...pinasse.org, hughd@...gle.com
Cc:     linux-mm@...ck.org, linux-kernel@...r.kernel.org,
        21cnbao@...il.com, zhangshiming@...o.com,
        lipeifeng <lipeifeng@...o.com>
Subject: [PATCH] mm: fix align-error when get_addr in unmapped_area_topdown

From: lipeifeng <lipeifeng@...o.com>

when we found a suitable gap_end(> info->high_limit), gap_end
must be set to info->high_limit. And we will get the gap_end
after computing highest gap address at the desired alignment.

2096 found:
2097         if (gap_end > info->high_limit)
2098                 gap_end = info->high_limit;
2099
2100 found_highest:
2101         gap_end -= info->length;
2102         gap_end -= (gap_end - info->align_offset) & info->align_mask;
2103
2104         VM_BUG_ON(gap_end < info->low_limit);
2105         VM_BUG_ON(gap_end < gap_start);
2106         return gap_end;

so we must promise: info->high_limit - info->low_limit >=
info->length + info->align_mask.
Or in rare cases(info->high_limit - info->low_limit <
info->length + info->align_mask) we will get the addr in
align-error if found suitable gap_end(> info->high_limit).

Signed-off-by: lipeifeng <lipeifeng@...o.com>
---
 mm/mmap.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/mm/mmap.c b/mm/mmap.c
index 30e33d3..a28ea5c 100644
--- a/mm/mmap.c
+++ b/mm/mmap.c
@@ -2009,7 +2009,6 @@ static unsigned long unmapped_area_topdown(struct vm_unmapped_area_info *info)
 	if (length < info->length)
 		return -ENOMEM;
 
-	length = info->length;
 	/*
 	 * Adjust search limits by the desired length.
 	 * See implementation comment at top of unmapped_area().
@@ -2021,6 +2020,8 @@ static unsigned long unmapped_area_topdown(struct vm_unmapped_area_info *info)
 
 	if (info->low_limit > high_limit)
 		return -ENOMEM;
+
+	length = info->length;
 	low_limit = info->low_limit + length;
 
 	/* Check highest gap, which does not precede any rbtree node */
-- 
2.7.4