diff options
| author | Russell King <rmk+kernel@arm.linux.org.uk> | 2012-05-16 15:19:20 +0100 |
|---|---|---|
| committer | Russell King <rmk+kernel@arm.linux.org.uk> | 2012-05-16 15:20:59 +0100 |
| commit | 9b61a4d1b2064dbd0c9e61754305ac852170509f (patch) | |
| tree | 0665524aa0636b7615a49748e5ddff818a231d45 /arch/arm/mm/fault.c | |
| parent | 998de4acb2ba188d20768d1065658377a2e7d29b (diff) | |
| download | linux-9b61a4d1b2064dbd0c9e61754305ac852170509f.tar.gz linux-9b61a4d1b2064dbd0c9e61754305ac852170509f.tar.bz2 linux-9b61a4d1b2064dbd0c9e61754305ac852170509f.zip | |
ARM: prevent VM_GROWSDOWN mmaps extending below FIRST_USER_ADDRESS
Cc: <stable@vger.kernel.org>
Reported-by: Al Viro <viro@zeniv.linux.org.uk>
Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk>
Diffstat (limited to 'arch/arm/mm/fault.c')
| -rw-r--r-- | arch/arm/mm/fault.c | 4 |
1 files changed, 3 insertions, 1 deletions
diff --git a/arch/arm/mm/fault.c b/arch/arm/mm/fault.c index f07467533365..5bb48356d217 100644 --- a/arch/arm/mm/fault.c +++ b/arch/arm/mm/fault.c @@ -247,7 +247,9 @@ good_area: return handle_mm_fault(mm, vma, addr & PAGE_MASK, flags); check_stack: - if (vma->vm_flags & VM_GROWSDOWN && !expand_stack(vma, addr)) + /* Don't allow expansion below FIRST_USER_ADDRESS */ + if (vma->vm_flags & VM_GROWSDOWN && + addr >= FIRST_USER_ADDRESS && !expand_stack(vma, addr)) goto good_area; out: return fault; |