Linux-Fsdevel Archive on lore.kernel.org
help / color / mirror / Atom feed
* [PATCH] [RFC] exec: the vma passed to shift_arg_pages() must not have next
@ 2020-08-31 1:51 Wei Yang
0 siblings, 0 replies; only message in thread
From: Wei Yang @ 2020-08-31 1:51 UTC (permalink / raw)
To: viro, akpm; +Cc: linux-fsdevel, linux-kernel, Wei Yang
We can divide vma_adjust() into two categories based on whether the
*insert* is NULL or not. And when *insert* is NULL, it has two users:
mremap() and shift_arg_pages().
For the second vma_adjust() in shift_arg_pages(), the vma must not have
next. Otherwise vma_adjust() would expand next->vm_start instead of just
shift the vma.
Fortunately, shift_arg_pages() is only used in setup_arg_pages() to move
stack, which is placed on the top of the address range. This means the
vma is not expected to have a next.
Since mremap() calls vma_adjust() to expand itself, shift_arg_pages() is
the only case it may fall into mprotect case 4 by accident. Let's add a
BUG_ON() and comment to inform the following audience.
Signed-off-by: Wei Yang <email@example.com>
fs/exec.c | 3 +++
1 file changed, 3 insertions(+)
diff --git a/fs/exec.c b/fs/exec.c
index a91003e28eaa..3ff44ab0d112 100644
@@ -682,6 +682,7 @@ static int shift_arg_pages(struct vm_area_struct *vma, unsigned long shift)
struct mmu_gather tlb;
BUG_ON(new_start > new_end);
* ensure there are no vmas between where we want to go
@@ -726,6 +727,8 @@ static int shift_arg_pages(struct vm_area_struct *vma, unsigned long shift)
* Shrink the vma to just the new range. Always succeeds.
+ * Since !vma->vm_next, __vma_adjust() would not go to mprotect case
+ * 4 to expand next.
vma_adjust(vma, new_start, new_end, vma->vm_pgoff, NULL);
2.20.1 (Apple Git-117)
^ permalink raw reply [flat|nested] only message in thread
only message in thread, other threads:[~2020-08-31 1:52 UTC | newest]
Thread overview: (only message) (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2020-08-31 1:51 [PATCH] [RFC] exec: the vma passed to shift_arg_pages() must not have next Wei Yang
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).