aboutsummaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorLiam R. Howlett <[email protected]>2023-02-24 16:20:55 -0500
committerLinus Torvalds <[email protected]>2023-02-25 20:16:48 -0800
commit2fcd07b7ccd5fd10b2120d298363e4e6c53ccf9c (patch)
treeca6494148a02cbc7ecf9b27340c134d6dad47e23
parent1ec35eadc3b448c91a6b763371a7073444e95f9d (diff)
mm/mprotect: Fix successful vma_merge() of next in do_mprotect_pkey()
If mprotect_fixup() successfully calls vma_merge() and replaces vma and the next vma, then the tmp variable in the do_mprotect_pkey() is not updated to point to the new vma end. This results in the loop detecting a gap between VMAs that does not exist. Fix the faulty value of tmp by setting it to the end location of the vma iterator at the end of the loop. Link: https://lkml.kernel.org/r/[email protected] Fixes: 2286a6914c77 ("mm: change mprotect_fixup to vma iterator") Link: https://lore.kernel.org/linux-mm/[email protected]/ Signed-off-by: Liam R. Howlett <[email protected]> Reported-by: Bert Karwatzki <[email protected]> Link: https://bugzilla.kernel.org/show_bug.cgi?id=217061 Tested-by: Bert Karwatzki <[email protected]> Reported-by: Linus Torvalds <[email protected]> Link: https://lore.kernel.org/linux-mm/CAHk-=wjFmVL7NiuxL54qLkoabni_yD-oF9=dpDgETtdsiCbhUg@mail.gmail.com/ Tested-by: Linus Torvalds <[email protected]> Signed-off-by: Andrew Morton <[email protected]> Signed-off-by: Linus Torvalds <[email protected]>
-rw-r--r--mm/mprotect.c1
1 files changed, 1 insertions, 0 deletions
diff --git a/mm/mprotect.c b/mm/mprotect.c
index 1d4843c97c2a..231929f119d9 100644
--- a/mm/mprotect.c
+++ b/mm/mprotect.c
@@ -832,6 +832,7 @@ static int do_mprotect_pkey(unsigned long start, size_t len,
if (error)
break;
+ tmp = vma_iter_end(&vmi);
nstart = tmp;
prot = reqprot;
}