s390/mm: fix BUG_ON in crst_table_upgrade (8ab867cb) · Commits · 戴 / test

A 31-bit compat process can force a BUG_ON in crst_table_upgrade with specific, invalid mmap calls, e.g. mmap((void*) 0x7fff8000, 0x10000, 3, 32, -1, 0) The arch_get_unmapped_area[_topdown] functions miss an if condition in the decision to do a page table upgrade. Fixes: ("s390/mm: simplify arch_get_unmapped_area[_topdown]") Cc: <stable@vger.kernel.org> # v4.12+ Signed-off-by:

Martin Schwidefsky <schwidefsky@de.ibm.com>

arch/s390/mm/mmap.c

+4 −2

Original line number	Diff line number	Diff line
		@@ -119,7 +119,8 @@ arch_get_unmapped_area(struct file *filp, unsigned long addr,
		return addr;

		check_asce_limit:
		if (addr + len > current->mm->context.asce_limit) {
		if (addr + len > current->mm->context.asce_limit &&
		addr + len <= TASK_SIZE) {
		rc = crst_table_upgrade(mm, addr + len);
		if (rc)
		return (unsigned long) rc;
		@@ -183,7 +184,8 @@ arch_get_unmapped_area_topdown(struct file *filp, const unsigned long addr0,
		}

		check_asce_limit:
		if (addr + len > current->mm->context.asce_limit) {
		if (addr + len > current->mm->context.asce_limit &&
		addr + len <= TASK_SIZE) {
		rc = crst_table_upgrade(mm, addr + len);
		if (rc)
		return (unsigned long) rc;

Admin message