Commit 7013d4d4 authored by Ma Wupeng's avatar Ma Wupeng Committed by Wupeng Ma
Browse files

mm/mlock: return EINVAL for illegal user memory range in mlock 

hulk inclusion
category: bugfix
bugzilla: https://gitee.com/openeuler/kernel/issues/I9C0QZ



--------------------------------

While testing mlock, we have a problem if the len of mlock is ULONG_MAX.
The return value of mlock is zero. But nothing will be locked since the
len in do_mlock overflows to zero due to the following code in mlock:

  len = PAGE_ALIGN(len + (offset_in_page(start)));

The same problem happens in munlock.

Fixes: 1da177e4 ("Linux-2.6.12-rc2")
Signed-off-by: default avatarMa Wupeng <mawupeng1@huawei.com>
parent e9ed7f86

mm/mlock.c

+11 −2
Original line number Diff line number Diff line
@@ -568,8 +568,6 @@ static int apply_vma_lock_flags(unsigned long start, size_t len, 
	end = start + len;

	if (end < start)

		return -EINVAL;

	if (end == start)

		return 0;

	vma = find_vma(current->mm, start);

	if (!vma || vma->vm_start > start)

		return -ENOMEM;
@@ -655,9 +653,15 @@ static __must_check int do_mlock(unsigned long start, size_t len, vm_flags_t fla 
	if (!can_do_mlock())

		return -EPERM;



	if (!len)

		return 0;



	len = PAGE_ALIGN(len + (offset_in_page(start)));

	start &= PAGE_MASK;



	if (!len)

		return -EINVAL;



	lock_limit = rlimit(RLIMIT_MEMLOCK);

	lock_limit >>= PAGE_SHIFT;

	locked = len >> PAGE_SHIFT;
@@ -715,8 +719,13 @@ SYSCALL_DEFINE2(munlock, unsigned long, start, size_t, len) 


	start = untagged_addr(start);



	if (!len)

		return 0;



	len = PAGE_ALIGN(len + (offset_in_page(start)));

	start &= PAGE_MASK;

	if (!len)

		return -EINVAL;



	if (mmap_write_lock_killable(current->mm))

		return -EINTR;