[PATCH] Fix MADV_REMOVE protection checking

madvise_remove needs to respect file and mmap protections. Signed-off-by: Hugh Dickins <hugh@veritas.com> [ Will the real CVE-2006-1524 stand up, please.. ] Signed-off-by: Linus Torvalds <torvalds@osdl.org>

[PATCH] Fix MADV_REMOVE protection checking
madvise_remove needs to respect file and mmap protections. Signed-off-by: Hugh Dickins <hugh@veritas.com> [ Will the real CVE-2006-1524 stand up, please.. ] Signed-off-by: Linus Torvalds <torvalds@osdl.org>
Hugh Dickins · Linus Torvalds
1 parent e14d95f773
Showing 1 changed file with 3 additions and 0 deletions Side-by-side Diff
mm/madvise.c
@@ -168,6 +168,9 @@
 			return -EINVAL;
 	}
  
+	if ((vma->vm_flags & (VM_SHARED|VM_WRITE)) != (VM_SHARED|VM_WRITE))
+		return -EACCES;
+
 	mapping = vma->vm_file->f_mapping;
  
 	offset = (loff_t)(start - vma->vm_start)
...	...	@@ -168,6 +168,9 @@
168	168	return -EINVAL;
169	169	}
170	170
	171	+ if ((vma->vm_flags & (VM_SHARED\|VM_WRITE)) != (VM_SHARED\|VM_WRITE))
	172	+ return -EACCES;
	173	+
171	174	mapping = vma->vm_file->f_mapping;
172	175
173	176	offset = (loff_t)(start - vma->vm_start)