aboutsummaryrefslogtreecommitdiff
path: root/arch
diff options
context:
space:
mode:
authorDavid Daney <ddaney@avtrex.com>2007-10-27 23:10:20 -0700
committerRalf Baechle <ralf@linux-mips.org>2007-10-29 19:35:36 +0000
commit098362e72002d01fdd18afee2e635ffdcdc89e2c (patch)
treebc886181f598356f5b010c16235b9069633685b8 /arch
parentc4e8308c30b0139f89bac71f3c22c8d7413b8665 (diff)
[MIPS] Add len and addr validation for MAP_FIXED mappings.
Mmap with MAP_FIXED was not validating the addr and len parameters. This leads to the failure of GCC's gcc.c-torture/execute/loop-2[fg].c testcases when using the o32 ABI on a 64 bit kernel. These testcases try to mmap 65536 bytes at 0x7fff8000 and then access all the memory. In 2.6.18 and 2.6.23.1 (and likely other versions as well) the kernel maps the requested memory, but since half of it is above 0x80000000 a SIGBUS is generated when it is accessed. This patch moves the len validation above the MAP_FIXED processing so that it is always validated. It also adds validation to the addr parameter for MAP_FIXED mappings. Signed-off-by: David Daney <ddaney@avtrex.com> Signed-off-by: Ralf Baechle <ralf@linux-mips.org>
Diffstat (limited to 'arch')
-rw-r--r--arch/mips/kernel/syscall.c9
1 files changed, 7 insertions, 2 deletions
diff --git a/arch/mips/kernel/syscall.c b/arch/mips/kernel/syscall.c
index b95fe93dd64..af1bdc89748 100644
--- a/arch/mips/kernel/syscall.c
+++ b/arch/mips/kernel/syscall.c
@@ -73,7 +73,14 @@ unsigned long arch_get_unmapped_area(struct file *filp, unsigned long addr,
task_size = STACK_TOP;
+ if (len > task_size)
+ return -ENOMEM;
+
if (flags & MAP_FIXED) {
+ /* Even MAP_FIXED mappings must reside within task_size. */
+ if (task_size - len < addr)
+ return -EINVAL;
+
/*
* We do not accept a shared mapping if it would violate
* cache aliasing constraints.
@@ -83,8 +90,6 @@ unsigned long arch_get_unmapped_area(struct file *filp, unsigned long addr,
return addr;
}
- if (len > task_size)
- return -ENOMEM;
do_color_align = 0;
if (filp || (flags & MAP_SHARED))
do_color_align = 1;