On Tue, 16 Jul 2013, Andrew Morton wrote: > On Sun, 14 Jul 2013 18:54:51 +0200 Oleg Nesterov <o...@redhat.com> wrote: > > > mmap() doesn't allow the non-anonymous mappings with VM_GROWS* bit set. > > In particular this means that mmap_region()->vma_merge(file, vm_flags) > > must always fail if vm_flags & VM_GROWS.
I didn't understand that sentence: if file is non-NULL perhaps? > > So it does not make sense to > > check VM_GROWS* after we already allocated the new vma, the only caller, > > do_mmap_pgoff(), which can pass this flag can do the check itself. > > > > And this looks a bit more correct, mmap_region() already unmapped the > > old mapping at this stage. But if mmap() is going to fail, it should > > avoid do_munmap() if possible. I agree with the sentiment, but the patch looks wrong to me. > > > > ... > > > > --- a/mm/mmap.c > > +++ b/mm/mmap.c > > @@ -1327,6 +1327,9 @@ unsigned long do_mmap_pgoff(struct file *file, > > unsigned long addr, > > } > > } > > > > + /* Only MAP_PRIVATE|MAP_ANONYMOUS can use MAP_GROWS */ > > + if ((vm_flags & VM_MAYSHARE) && (vm_flags & (VM_GROWSDOWN|VM_GROWSUP))) > > That is of course vm_flags&(VM_MAYSHARE|VM_GROWSDOWN|VM_GROWSUP), Seems very plausible, but I believe you're wrong on that! > but that perhaps is less clear. > > > + return -EINVAL; > > I had to stare for a while but yes, the change looks OK to me. It did need staring, yes, but it looks NOK to me: this change permits mmap(addr, len, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_GROWSDOWN, fd, off) where fd is for a real file: we never allowed MAP_GROWSDOWN on private (or shared) mappings of real files before, and I think we should not now. Hugh -- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majord...@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/
