Re: [PATCH 1/3] ima: Remove inode lock
From: Kirill A. Shutemov <hidden>
Date: 2024-10-18 10:55:54
Also in:
bpf, linux-fsdevel, linux-integrity, linux-mm, lkml
Subsystem:
memory management, memory mapping, the rest · Maintainers:
Andrew Morton, Liam R. Howlett, Lorenzo Stoakes, Linus Torvalds
On Fri, Oct 18, 2024 at 01:53:03PM +0300, Kirill A. Shutemov wrote:
quoted
+ mmap_read_unlock(mm); + + ret = security_mmap_file(vma->vm_file, prot, flags); + if (ret) { + fput(file); + return ret; + } +Emm. We need to restore 'ret' to -EINVAL here: + + ret = -EINVAL; +quoted
if (mmap_write_lock_killable(mm)) return -EINTR;
And fput() here on error. Updated patch:
diff --git a/mm/mmap.c b/mm/mmap.c
index dd4b35a25aeb..7c1b73a79937 100644
--- a/mm/mmap.c
+++ b/mm/mmap.c@@ -1646,14 +1646,41 @@ SYSCALL_DEFINE5(remap_file_pages, unsigned long, start, unsigned long, size, if (pgoff + (size >> PAGE_SHIFT) < pgoff) return ret; - if (mmap_write_lock_killable(mm)) + if (mmap_read_lock_killable(mm)) return -EINTR; vma = vma_lookup(mm, start); + if (!vma || !(vma->vm_flags & VM_SHARED)) { + mmap_read_unlock(mm); + return -EINVAL; + } + + file = get_file(vma->vm_file); + + mmap_read_unlock(mm); + + ret = security_mmap_file(vma->vm_file, prot, flags); + if (ret) { + fput(file); + return ret; + } + + ret = -EINVAL; + + if (mmap_write_lock_killable(mm)) { + fput(file); + return -EINTR; + } + + vma = vma_lookup(mm, start); + if (!vma || !(vma->vm_flags & VM_SHARED)) goto out; + if (vma->vm_file != file) + goto out; + if (start + size > vma->vm_end) { VMA_ITERATOR(vmi, mm, vma->vm_end); struct vm_area_struct *next, *prev = vma;
@@ -1688,16 +1715,11 @@ SYSCALL_DEFINE5(remap_file_pages, unsigned long, start, unsigned long, size, if (vma->vm_flags & VM_LOCKED) flags |= MAP_LOCKED; - file = get_file(vma->vm_file); - ret = security_mmap_file(vma->vm_file, prot, flags); - if (ret) - goto out_fput; ret = do_mmap(vma->vm_file, start, size, prot, flags, 0, pgoff, &populate, NULL); -out_fput: - fput(file); out: mmap_write_unlock(mm); + fput(file); if (populate) mm_populate(ret, populate); If (!IS_ERR_VALUE(ret))
--
Kiryl Shutsemau / Kirill A. Shutemov