From patchwork Tue Mar 21 07:40:32 2023 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: mawupeng X-Patchwork-Id: 13182342 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from kanga.kvack.org (kanga.kvack.org [205.233.56.17]) by smtp.lore.kernel.org (Postfix) with ESMTP id 966D6C761A6 for ; Tue, 21 Mar 2023 07:40:51 +0000 (UTC) Received: by kanga.kvack.org (Postfix) id 2F52B6B007B; Tue, 21 Mar 2023 03:40:49 -0400 (EDT) Received: by kanga.kvack.org (Postfix, from userid 40) id 1F3176B0081; Tue, 21 Mar 2023 03:40:48 -0400 (EDT) X-Delivered-To: int-list-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix, from userid 63042) id D754C6B007B; Tue, 21 Mar 2023 03:40:48 -0400 (EDT) X-Delivered-To: linux-mm@kvack.org Received: from relay.hostedemail.com (smtprelay0010.hostedemail.com [216.40.44.10]) by kanga.kvack.org (Postfix) with ESMTP id C4BF96B0078 for ; Tue, 21 Mar 2023 03:40:48 -0400 (EDT) Received: from smtpin23.hostedemail.com (a10.router.float.18 [10.200.18.1]) by unirelay01.hostedemail.com (Postfix) with ESMTP id 9175E1C6CAC for ; Tue, 21 Mar 2023 07:40:48 +0000 (UTC) X-FDA: 80592108576.23.632F6C1 Received: from szxga01-in.huawei.com (szxga01-in.huawei.com [45.249.212.187]) by imf02.hostedemail.com (Postfix) with ESMTP id 4038080005 for ; Tue, 21 Mar 2023 07:40:45 +0000 (UTC) Authentication-Results: imf02.hostedemail.com; dkim=none; spf=pass (imf02.hostedemail.com: domain of mawupeng1@huawei.com designates 45.249.212.187 as permitted sender) smtp.mailfrom=mawupeng1@huawei.com; dmarc=pass (policy=quarantine) header.from=huawei.com ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=hostedemail.com; s=arc-20220608; t=1679384446; h=from:from:sender:reply-to:subject:subject:date:date: message-id:message-id:to:to:cc:cc:mime-version:mime-version: content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=ifVVFs5bwlnPk8NflEfbMhrEG7oBpaPnYOyIHSPKgkE=; b=4wAT03I0wIM9lEl7jzhjIJjcOH4bFzeBZ2R7OkFvnDz50HoovC0vTurdybD9Sybe8e5ZJN 6NLdsowAwfakMFPx5L0d5+Rq9m/rNJz+zeDt9MP3cJbd4fk5osXpCwBTwsiHfgDhZINot+ wSq/X4JybUgM0b+a0nAziK3x4FS8PQw= ARC-Authentication-Results: i=1; imf02.hostedemail.com; dkim=none; spf=pass (imf02.hostedemail.com: domain of mawupeng1@huawei.com designates 45.249.212.187 as permitted sender) smtp.mailfrom=mawupeng1@huawei.com; dmarc=pass (policy=quarantine) header.from=huawei.com ARC-Seal: i=1; s=arc-20220608; d=hostedemail.com; t=1679384446; a=rsa-sha256; cv=none; b=fPxRezvZ/CJcg0VuEKs0WGIUtsgDR6+96RODWKByrwZw84/nZ58Ro253YQVK5EXtOPgr5f tBiwfDEOo3uwqnnFPLfMwk8iVDG4s54KjUNCLtnut7T2Roa9KSyBPMxlJYDqTNNmM+b+ck mf2IfndXKKjTaMH4vQ/kjcBoVweb0X8= Received: from dggpemm500014.china.huawei.com (unknown [172.30.72.54]) by szxga01-in.huawei.com (SkyGuard) with ESMTP id 4Pgk325l0PznYR6; Tue, 21 Mar 2023 15:37:34 +0800 (CST) Received: from localhost.localdomain (10.175.112.125) by dggpemm500014.china.huawei.com (7.185.36.153) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256) id 15.1.2507.21; Tue, 21 Mar 2023 15:40:40 +0800 From: Wupeng Ma To: , CC: , , , , Subject: [PATCH v5 1/4] mm/mlock: return EINVAL if len overflows for mlock/munlock Date: Tue, 21 Mar 2023 15:40:32 +0800 Message-ID: <20230321074035.1526157-2-mawupeng1@huawei.com> X-Mailer: git-send-email 2.25.1 In-Reply-To: <20230321074035.1526157-1-mawupeng1@huawei.com> References: <20230321074035.1526157-1-mawupeng1@huawei.com> MIME-Version: 1.0 X-Originating-IP: [10.175.112.125] X-ClientProxiedBy: dggems706-chm.china.huawei.com (10.3.19.183) To dggpemm500014.china.huawei.com (7.185.36.153) X-CFilter-Loop: Reflected X-Stat-Signature: 781po8hjyedqcydbikwz7nda8ews4t1q X-Rspam-User: X-Rspamd-Queue-Id: 4038080005 X-Rspamd-Server: rspam06 X-HE-Tag: 1679384445-563328 X-HE-Meta: U2FsdGVkX19wBlzRHnoED2+aUxrCfoKLA0UdRIGPeDJkgmd8G6bkjHnBzprqOxdgj9NCkoGKz8vlpEoy36JEYRdx0FNKbIvfPp3PUY8mWly2I6XUkeDHprVqr63c0S8YlnrVVmuit3jFRwe06n8eaYom40T2lfStQ6ZZZFP3Zmu+rYtBSC/5jHndqCBIyqo6Gk2W7E3Tj1J2IPyIVl0EtnEEhV9rHC0fDVRGjc2FHbGwxdy7ev/Z6355RkVXVaZUq+DzUxpFcISkmOkSOuEmav4XobVt5WKkUiTYEOkgQ1Pm12V2wnEeCUyacNgol0oXo+0bHEmeLtc+ATrYdfXOamVA2lBS2LiEUthKco0ZO3C6B9zilLuGjvWQ0NwjAbolytUie29Hg4cpZWEf483iOAoE4rwgdWuQK7aLeDjwhp52d6Eci7v9kN6xTrM+vWMYP7tK/WfU57zvf4UiCT34T3MOSVxM1VQ4H1cQHeehtW0EPcC2giiR5RVnWVG+yCUlmuf7C0eNA3ZYk5w5yr//Gju3XZunpMasYKYean/G0nqdRU1pI+hZhvNDc+RkwCnUkH87wCmh6IAo0U7BTOasMdZ/UsN1Vxc78Zldx47RT7yZhG2cb0iMek6w8Y04AhNMZB9NRDHaCRmTuWFAIJHTM0yopEBUKJkevwQfLApZAdiVhTjN8vWE3QV3GA2+FYnbCx1RaQ+cgIqtzkyjZw1Lig7jeoN33WZe4hWragcuStw9s4CWNyqz82roLIGLPecl5Q1JyV1ToQrYbxJSwFJHHFzfTL2zL2PGefXc4AgIrNMachiJ/0Llsau4tul6KHzLwoREmIHY2B3z4Wy/mKJR8GvS1BskzKWm83K79RRSsy+pUDeOMLZxPJSHj9PQOPrd757gzGmMD5bJePgiRIxkKXDwUGRy/C5Z9mSvmJN+PwYr0GTT7t38gBrBTGvhTZzHmgNEcK0fBPVSRbDJsnq oO2HlEp6 iURUdxCZIJ4lM8W0occkrI4bcSAqKtWa5p133hN4ojmA8M01Vam/kGAF9CSedjzOokoP06Q7VOIaL5UjWG9tESBvdLRyC6vLonX8S61U8Kf7uV7reeC1XqkoVMEEcK+TjodJKvZctaUSPGksAH4wckVRX+/055paVei7A X-Bogosity: Ham, tests=bogofilter, spamicity=0.000000, version=1.2.4 Sender: owner-linux-mm@kvack.org Precedence: bulk X-Loop: owner-majordomo@kvack.org List-ID: From: Ma Wupeng While testing mlock, we have a problem if the len of mlock is ULONG_MAX. The return value of mlock is zero. But nothing will be locked since the len in do_mlock overflows to zero due to the following code in mlock: len = PAGE_ALIGN(len + (offset_in_page(start))); The same problem happens in munlock. Add new check and return -EINVAL to fix this overflowing scenarios since they are absolutely wrong. Return 0 early to avoid burn a bunch of cpu cycles if len == 0. Signed-off-by: Ma Wupeng --- mm/mlock.c | 14 ++++++++++++-- 1 file changed, 12 insertions(+), 2 deletions(-) diff --git a/mm/mlock.c b/mm/mlock.c index 617469fce96d..247ce396bb16 100644 --- a/mm/mlock.c +++ b/mm/mlock.c @@ -479,8 +479,6 @@ static int apply_vma_lock_flags(unsigned long start, size_t len, end = start + len; if (end < start) return -EINVAL; - if (end == start) - return 0; vma = vma_iter_load(&vmi); if (!vma) return -ENOMEM; @@ -574,7 +572,13 @@ static __must_check int do_mlock(unsigned long start, size_t len, vm_flags_t fla if (!can_do_mlock()) return -EPERM; + if (!len) + return 0; + len = PAGE_ALIGN(len + (offset_in_page(start))); + if (!len) + return -EINVAL; + start &= PAGE_MASK; lock_limit = rlimit(RLIMIT_MEMLOCK); @@ -634,7 +638,13 @@ SYSCALL_DEFINE2(munlock, unsigned long, start, size_t, len) start = untagged_addr(start); + if (!len) + return 0; + len = PAGE_ALIGN(len + (offset_in_page(start))); + if (!len) + return -EINVAL; + start &= PAGE_MASK; if (mmap_write_lock_killable(current->mm))