[PATCH] mm: madvise: complete input validation before taking lock

[Rasmus Villemoes]

In madvise(), there doesn't seem to be any reason for taking the
&current->mm->mmap_sem before start and len_in have been
validated. Incidentally, this removes the need for the out: label.


Signed-off-by: Rasmus Villemoes <li...@rasmusvillemoes.dk>
---

diff --git a/mm/madvise.c b/mm/madvise.c
index c58c94b..d2ae668 100644
--- a/mm/madvise.c
+++ b/mm/madvise.c
@@ -473,27 +473,27 @@ SYSCALL_DEFINE3(madvise, unsigned long, start, size_t, 
len_in, int, behavior)
        if (!madvise_behavior_valid(behavior))
                return error;
 
-       write = madvise_need_mmap_write(behavior);
-       if (write)
-               down_write(&current->mm->mmap_sem);
-       else
-               down_read(&current->mm->mmap_sem);
-
        if (start & ~PAGE_MASK)
-               goto out;
+               return error;
        len = (len_in + ~PAGE_MASK) & PAGE_MASK;
 
        /* Check to see whether len was rounded up from small -ve to zero */
        if (len_in && !len)
-               goto out;
+               return error;
 
        end = start + len;
        if (end < start)
-               goto out;
+               return error;
 
        error = 0;
        if (end == start)
-               goto out;
+               return error;
+
+       write = madvise_need_mmap_write(behavior);
+       if (write)
+               down_write(&current->mm->mmap_sem);
+       else
+               down_read(&current->mm->mmap_sem);
 
        /*
         * If the interval [start,end) covers some unmapped address
@@ -541,7 +541,6 @@ SYSCALL_DEFINE3(madvise, unsigned long, start, size_t, 
len_in, int, behavior)
        }
 out_plug:
        blk_finish_plug(&plug);
-out:
        if (write)
                up_write(&current->mm->mmap_sem);
        else
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majord...@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/