Re: 2.6.1-rc1 affected?

[Linus Torvalds <torvalds _at_ xxxxxxxx>]

On Mon, 5 Jan 2004, Markus H舖tbacka wrote:
> 
> I heard the news about the new exploit, and I'm wondering if 2.6.0 or
> 2.6.1-rc1 is affected with this mremap bug?

Yup.

I'd actually personally prefer a stronger test than the one in 2.4.24, and 
my personal preference would be for just disallowing the degenerate cases
entirely.  I don't see a "mremap away" as being a valid thing to do, since 
if that is what you want, why not just do a "munmap()"?

Uli cc'd, to check whether libc could ever use a zero-sized mremap()..

		Linus

----
===== mm/mremap.c 1.33 vs edited =====
--- 1.33/mm/mremap.c	Sat Aug 23 23:50:10 2003
+++ edited/mm/mremap.c	Mon Jan  5 08:34:21 2004
@@ -315,6 +315,10 @@
 	old_len = PAGE_ALIGN(old_len);
 	new_len = PAGE_ALIGN(new_len);
 
+	/* Don't allow the degenerate cases */
+	if (!(old_len | new_len))
+		goto out;
+
 	/* new_addr is only valid if MREMAP_FIXED is specified */
 	if (flags & MREMAP_FIXED) {
 		if (new_addr & ~PAGE_MASK)
-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo _at_ vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/