diff options
| author | Jiri Kosina <jkosina@suse.cz> | 2008-02-06 22:39:44 +0100 |
|---|---|---|
| committer | Ingo Molnar <mingo@elte.hu> | 2008-02-06 22:39:44 +0100 |
| commit | 4cc6028d4040f95cdb590a87db478b42b8be0508 (patch) | |
| tree | 9b9879d8b8cc055e4bb8eabd69b979a17e6e52cd /mm/mmap.c | |
| parent | 2d684cd6d9cf0c6a0e28978362671b6e2d8fb56c (diff) | |
| download | linux-stable-4cc6028d4040f95cdb590a87db478b42b8be0508.tar.gz linux-stable-4cc6028d4040f95cdb590a87db478b42b8be0508.tar.bz2 linux-stable-4cc6028d4040f95cdb590a87db478b42b8be0508.zip | |
brk: check the lower bound properly
There is a check in sys_brk(), that tries to make sure that we do not
underflow the area that is dedicated to brk heap.
The check is however wrong, as it assumes that brk area starts immediately
after the end of the code (+bss), which is wrong for example in
environments with randomized brk start. The proper way is to check whether
the address is not below the start_brk address.
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
Signed-off-by: Ingo Molnar <mingo@elte.hu>
Diffstat (limited to 'mm/mmap.c')
| -rw-r--r-- | mm/mmap.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/mm/mmap.c b/mm/mmap.c index bb4c963cc534..ad6e4eaf34f8 100644 --- a/mm/mmap.c +++ b/mm/mmap.c @@ -245,7 +245,7 @@ asmlinkage unsigned long sys_brk(unsigned long brk) down_write(&mm->mmap_sem); - if (brk < mm->end_code) + if (brk < mm->start_brk) goto out; /* |