Messages in this thread |  | | From | Wupeng Ma <> | Subject | [PATCH 0/4] return EINVAL for illegal user memory range | Date | Mon, 5 Dec 2022 11:41:04 +0800 |
| |
From: Ma Wupeng <mawupeng1@huawei.com>
While testing mlock, we have a problem if the len of mlock is ULONG_MAX. The return value of mlock is zero. But nothing will be locked since the len in do_mlock overflows to zero due to the following code in mlock:
len = PAGE_ALIGN(len + (offset_in_page(start)));
However this problem appear in multiple syscalls.
Since TASK_SIZE is the maximum user space address. The start or len of mlock shouldn't be bigger than this. Function access_ok can be used to check this issue, so return -EINVAL if bigger.
Ma Wupeng (4): mm/mlock: return EINVAL for illegal user memory range in mlock mm/mempolicy: return EINVAL for illegal user memory range for set_mempolicy_home_node mm/mempolicy: return EINVAL for illegal user memory range for mbind mm/msync: return EINVAL for illegal user memory range for msync
mm/mempolicy.c | 7 +++++++ mm/mlock.c | 6 ++++++ mm/msync.c | 2 ++ 3 files changed, 15 insertions(+)
-- 2.25.1
|  |