summaryrefslogtreecommitdiff
path: root/mm
diff options
context:
space:
mode:
authorSebastian Ott <sebott@redhat.com>2023-09-29 20:19:41 +0300
committerAndrew Morton <akpm@linux-foundation.org>2023-10-07 00:11:38 +0300
commite0f81ab1e4f42ffece6440dc78f583eb352b9a71 (patch)
treee1dd4a6ade832ee3794efcfd2f6713e6d0863b20 /mm
parent51f625377561e5b167da2db5aafb7ee268f691c5 (diff)
downloadlinux-e0f81ab1e4f42ffece6440dc78f583eb352b9a71.tar.xz
mm: fix vm_brk_flags() to not bail out while holding lock
Calling vm_brk_flags() with flags set other than VM_EXEC will exit the function without releasing the mmap_write_lock. Just do the sanity check before the lock is acquired. This doesn't fix an actual issue since no caller sets a flag other than VM_EXEC. Link: https://lkml.kernel.org/r/20230929171937.work.697-kees@kernel.org Fixes: 2e7ce7d354f2 ("mm/mmap: change do_brk_flags() to expand existing VMA and add do_brk_munmap()") Signed-off-by: Sebastian Ott <sebott@redhat.com> Signed-off-by: Kees Cook <keescook@chromium.org> Reviewed-by: Liam R. Howlett <Liam.Howlett@oracle.com> Cc: Yu Zhao <yuzhao@google.com> Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Diffstat (limited to 'mm')
-rw-r--r--mm/mmap.c6
1 files changed, 3 insertions, 3 deletions
diff --git a/mm/mmap.c b/mm/mmap.c
index b56a7f0c9f85..7ed286662839 100644
--- a/mm/mmap.c
+++ b/mm/mmap.c
@@ -3143,13 +3143,13 @@ int vm_brk_flags(unsigned long addr, unsigned long request, unsigned long flags)
if (!len)
return 0;
- if (mmap_write_lock_killable(mm))
- return -EINTR;
-
/* Until we need other flags, refuse anything except VM_EXEC. */
if ((flags & (~VM_EXEC)) != 0)
return -EINVAL;
+ if (mmap_write_lock_killable(mm))
+ return -EINTR;
+
ret = check_brk_limits(addr, len);
if (ret)
goto limits_failed;