On Mon, Sep 24, 2012 at 11:29:09AM -0700, Eric W. Biederman wrote:

quoted

 
+#ifdef CONFIG_MMU
 	if (addr >= TASK_SIZE || addr < mmap_min_addr)
+#else
+	if (addr >= TASK_SIZE)
+#endif

I expect what you want is a call to access_ok, rather than hard coding
details about task layout here.  This test certainly looks wrong
for a 32bit process on a 64bit kernel. If I read your test right it
appears I can set values of say 0x100000000 on a 32bit process...

As for mmap_min_addr I would expect your find_vma check would make that
test unnecessary, simply by not finding a vma...

Good point, Eric, thanks! I'm cooking a new patch now.