mmap

Hi all,

When tracking mmaps from LSM with the following hook:

static int file_mmap(struct file *file, unsigned long reqprot,
        unsigned long prot, unsigned long flags,
                unsigned long addr, unsigned long addr_only);

I often get:
file = NULL
flags = 0x0 (MAP_FILE)
prot = 0x0 (PROT_NONE)

I am wondering what is the use for mmap with MAP_FILE and PROT_NONE together ?
Not sure how to interpret that ?

-- 
Christophe

Hi...

On Thu, Aug 23, 2012 at 8:06 PM, Christophe Hauser
[off-list ref] wrote:

I often get:
file = NULL
flags = 0x0 (MAP_FILE)
prot = 0x0 (PROT_NONE)

I am wondering what is the use for mmap with MAP_FILE and PROT_NONE together ?
Not sure how to interpret that ?

hmm, things that cross my mind:
- protecting low memory address (capturing null pointer abuse)

- stack guard...to catch buffer over flow

Maybe there are others.... CMIIW

-- 
regards,

Mulyadi Santosa
Freelance Linux trainer and consultant

blog: the-hydra.blogspot.com
training: mulyaditraining.blogspot.com