[PATCH] Fix bound checking in do_mmap_pgoff()

[PATCH] Fix bound checking in do_mmap_pgoff()

[Benjamin Herrenschmidt]

Hi !

A small issue has been forever in do_mmap_pgoff() in the boundary checking
in the sense that it won't let you mmap with offset+len enclosing the last
page of the "address space". For example, an mmap of /dev/mem won't let you
map the last page of the physical address space (which I need for a ROM dump
tool on pmac). This fixes it:

Signed-off-by: Benjamin Herrenschmidt <benh@kernel.crashing.org>

===== mm/mmap.c 1.144 vs edited =====
--- 1.144/mm/mmap.c	2004-09-03 19:08:17 +10:00
+++ edited/mm/mmap.c	2004-09-19 18:04:34 +10:00
@@ -801,7 +801,7 @@
 		return -EINVAL;
 
 	/* offset overflow? */
-	if ((pgoff + (len >> PAGE_SHIFT)) < pgoff)
+	if ((pgoff + (len >> PAGE_SHIFT) - 1) < pgoff)
 		return -EINVAL;
 
 	/* Too many mappings? */

Re: [PATCH] Fix bound checking in do_mmap_pgoff()

[Hugh Dickins]

On Sun, 19 Sep 2004, Benjamin Herrenschmidt wrote:
> 
> A small issue has been forever in do_mmap_pgoff() in the boundary checking
> in the sense that it won't let you mmap with offset+len enclosing the last
> page of the "address space". For example, an mmap of /dev/mem won't let you
> map the last page of the physical address space (which I need for a ROM dump
> tool on pmac). This fixes it:
> -	if ((pgoff + (len >> PAGE_SHIFT)) < pgoff)
> +	if ((pgoff + (len >> PAGE_SHIFT) - 1) < pgoff)

Your physical address space happens to be 16TB?  Okay...

I think you need to add in the patch below, to prevent mismerging of vmas.
There might be other places which would get confused by an end pgoff of 0.

Hugh

--- 2.6.9-rc2/mm/mmap.c	2004-09-13 17:54:41.000000000 +0100
+++ linux/mm/mmap.c	2004-09-19 13:50:07.650860552 +0100
@@ -529,10 +529,6 @@ static inline int is_mergeable_anon_vma(
  *
  * We cannot merge two vmas if they have differently assigned (non-NULL)
  * anon_vmas, nor if same anon_vma is assigned but offsets incompatible.
- *
- * We don't check here for the merged mmap wrapping around the end of pagecache
- * indices (16TB on ia32) because do_mmap_pgoff() does not permit mmap's which
- * wrap, nor mmaps which cover the final page at index -1UL.
  */
 static int
 can_vma_merge_before(struct vm_area_struct *vma, unsigned long vm_flags,
@@ -540,7 +536,7 @@ can_vma_merge_before(struct vm_area_stru
 {
 	if (is_mergeable_vma(vma, file, vm_flags) &&
 	    is_mergeable_anon_vma(anon_vma, vma->anon_vma)) {
-		if (vma->vm_pgoff == vm_pgoff)
+		if (vma->vm_pgoff == vm_pgoff && vm_pgoff != 0)
 			return 1;
 	}
 	return 0;
@@ -561,7 +557,7 @@ can_vma_merge_after(struct vm_area_struc
 	    is_mergeable_anon_vma(anon_vma, vma->anon_vma)) {
 		pgoff_t vm_pglen;
 		vm_pglen = (vma->vm_end - vma->vm_start) >> PAGE_SHIFT;
-		if (vma->vm_pgoff + vm_pglen == vm_pgoff)
+		if (vma->vm_pgoff + vm_pglen == vm_pgoff && vm_pgoff != 0)
 			return 1;
 	}
 	return 0;

Re: [PATCH] Fix bound checking in do_mmap_pgoff()

[Benjamin Herrenschmidt]

On Sun, 2004-09-19 at 22:59, Hugh Dickins wrote:
> On Sun, 19 Sep 2004, Benjamin Herrenschmidt wrote:
> > 
> > A small issue has been forever in do_mmap_pgoff() in the boundary checking
> > in the sense that it won't let you mmap with offset+len enclosing the last
> > page of the "address space". For example, an mmap of /dev/mem won't let you
> > map the last page of the physical address space (which I need for a ROM dump
> > tool on pmac). This fixes it:
> > -	if ((pgoff + (len >> PAGE_SHIFT)) < pgoff)
> > +	if ((pgoff + (len >> PAGE_SHIFT) - 1) < pgoff)
> 
> Your physical address space happens to be 16TB?  Okay...

hrm... nope... my bad, the problem comes from elsewhere, sorry. I need
to look at it again.

> I think you need to add in the patch below, to prevent mismerging of vmas.
> There might be other places which would get confused by an end pgoff of 0.

Ok, that's becoming more tricky then, Andrew, of course drop the bogus
patch for now, I'll look into more details later if I find time. In the
meantime, we'll continue use a special kernel module for doing the
ROM dump.

Ben.