[PATCH, RESEND] ipc/shm: fix crash if CONFIG_SHMEM is not set

[PATCH, RESEND] ipc/shm: fix crash if CONFIG_SHMEM is not set

[Kirill A. Shutemov]

Commit c01d5b300774 makes use of shm_get_unmapped_area() in
shm_file_operations() unconditional to CONFIG_MMU.

As Tony Battersby pointed this can lead NULL-pointer dereference on
machine with CONFIG_MMU=y and CONFIG_SHMEM=n. In this case ipc/shm is
backed by ramfs which doesn't provide f_op->get_unmapped_area for
configurations with MMU.

The solution is to provide dummy f_op->get_unmapped_area for ramfs when
CONFIG_MMU=y, which just call current->mm->get_unmapped_area().

Signed-off-by: Kirill A. Shutemov <kirill.shutemov@linux.intel.com>
Reported-and-Tested-by: Tony Battersby <tonyb@cybernetics.com>
Fixes: c01d5b300774 ("shmem: get_unmapped_area align huge page")
---
 fs/ramfs/file-mmu.c | 9 +++++++++
 1 file changed, 9 insertions(+)

diff --git a/fs/ramfs/file-mmu.c b/fs/ramfs/file-mmu.c
index 183a212694bf..12af0490322f 100644
--- a/fs/ramfs/file-mmu.c
+++ b/fs/ramfs/file-mmu.c
@@ -27,9 +27,17 @@
 #include <linux/fs.h>
 #include <linux/mm.h>
 #include <linux/ramfs.h>
+#include <linux/sched.h>
 
 #include "internal.h"
 
+static unsigned long ramfs_mmu_get_unmapped_area(struct file *file,
+		unsigned long addr, unsigned long len, unsigned long pgoff,
+		unsigned long flags)
+{
+	return current->mm->get_unmapped_area(file, addr, len, pgoff, flags);
+}
+
 const struct file_operations ramfs_file_operations = {
 	.read_iter	= generic_file_read_iter,
 	.write_iter	= generic_file_write_iter,
@@ -38,6 +46,7 @@ const struct file_operations ramfs_file_operations = {
 	.splice_read	= generic_file_splice_read,
 	.splice_write	= iter_file_splice_write,
 	.llseek		= generic_file_llseek,
+	.get_unmapped_area	= ramfs_mmu_get_unmapped_area,
 };
 
 const struct inode_operations ramfs_file_inode_operations = {
-- 
2.9.3

--
To unsubscribe, send a message with 'unsubscribe linux-mm' in
the body to majordomo@kvack.org.  For more info on Linux MM,
see: http://www.linux-mm.org/ .
Don't email: <a href=mailto:"dont@kvack.org"> email@kvack.org </a>

Re: [PATCH, RESEND] ipc/shm: fix crash if CONFIG_SHMEM is not set

[Andrew Morton]

On Mon, 12 Sep 2016 13:27:04 +0300 "Kirill A. Shutemov" <kirill.shutemov@linux.intel.com> wrote:

> Commit c01d5b300774 makes use of shm_get_unmapped_area() in
> shm_file_operations() unconditional to CONFIG_MMU.
> 
> As Tony Battersby pointed this can lead NULL-pointer dereference on
> machine with CONFIG_MMU=y and CONFIG_SHMEM=n. In this case ipc/shm is
> backed by ramfs which doesn't provide f_op->get_unmapped_area for
> configurations with MMU.
> 
> The solution is to provide dummy f_op->get_unmapped_area for ramfs when
> CONFIG_MMU=y, which just call current->mm->get_unmapped_area().
> 
> Signed-off-by: Kirill A. Shutemov <kirill.shutemov@linux.intel.com>
> Reported-and-Tested-by: Tony Battersby <tonyb@cybernetics.com>
> Fixes: c01d5b300774 ("shmem: get_unmapped_area align huge page")

I'll add

Cc: <stable@vger.kernel.org>    [4.7.x]

--
To unsubscribe, send a message with 'unsubscribe linux-mm' in
the body to majordomo@kvack.org.  For more info on Linux MM,
see: http://www.linux-mm.org/ .
Don't email: <a href=mailto:"dont@kvack.org"> email@kvack.org </a>