Commit baa4e700 authored by Liam Howlett's avatar Liam Howlett Committed by Liu Shixin
Browse files

mm/mmap.c: don't unlock VMAs in remap_file_pages() 

mainline inclusion
from mainline-v5.13-rc1
commit fce000b1
category: bugfix
bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAYQSE
CVE: CVE-2024-47745

Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=fce000b1bc08c64c0cff4bb705b3970bd6fc1e34

--------------------------------

Since this call uses MAP_FIXED, do_mmap() will munlock the necessary
range.  There is also an error in the loop test expression which will
evaluate as false and the loop body has never execute.

Link: https://lkml.kernel.org/r/20210223235010.2296915-1-Liam.Howlett@Oracle.com


Signed-off-by: default avatarLiam R. Howlett <Liam.Howlett@Oracle.com>
Acked-by: default avatarHugh Dickins <hughd@google.com>
Reviewed-by: default avatarMatthew Wilcox (Oracle) <willy@infradead.org>
Reviewed-by: default avatarDavid Hildenbrand <david@redhat.com>
Signed-off-by: default avatarAndrew Morton <akpm@linux-foundation.org>
Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: default avatarLiu Shixin <liushixin2@huawei.com>
parent d26629f1

mm/mmap.c

+1 −17
Original line number Diff line number Diff line
@@ -3139,25 +3139,9 @@ SYSCALL_DEFINE5(remap_file_pages, unsigned long, start, unsigned long, size, 


	flags &= MAP_NONBLOCK;

	flags |= MAP_SHARED | MAP_FIXED | MAP_POPULATE;

	if (vma->vm_flags & VM_LOCKED) {

		struct vm_area_struct *tmp;

	if (vma->vm_flags & VM_LOCKED)

		flags |= MAP_LOCKED;



		/* drop PG_Mlocked flag for over-mapped range */

		for (tmp = vma; tmp->vm_start >= start + size;

				tmp = tmp->vm_next) {

			/*

			 * Split pmd and munlock page on the border

			 * of the range.

			 */

			vma_adjust_trans_huge(tmp, start, start + size, 0);



			munlock_vma_pages_range(tmp,

					max(tmp->vm_start, start),

					min(tmp->vm_end, start + size));

		}

	}



	file = get_file(vma->vm_file);

	ret = do_mmap(vma->vm_file, start, size,

			prot, flags, pgoff, &populate, NULL);