boundary condition bug in do_mmap()

boundary condition bug in do_mmap()

[Tania Oka]

Hello

There seems to be a boundary condition bug in do_mmap()
(include/linux/mm.h).  It is in kernels as late as 2.4.4 (not sure about
later).   I saw it reported on a mailing list a year ago but I guess it
didn't make it to the right place.

In the inline function do_mmap(), there is a check for overflow of the
topmost address (line 449 of include/linux/mm.h in the 2.4.4 kernel I
have):

    if ((offset + PAGE_ALIGN(len)) < offset)

This test causes the function to return -EINVAL if offset is 0xfffff000
and len is 0x1000, although these should be valid values to map the last
4K according to the mmap() man page.

Please forward this to the right place.  I couldn't find anyone specific
in the MAINTAINERS file.

Thank you,
Tania

Re: boundary condition bug in do_mmap()

[Rik van Riel]

On Wed, 30 May 2001, Tania Oka wrote:

>     if ((offset + PAGE_ALIGN(len)) < offset)

Why are you mailing this the week after it was
fixed ?  :)

Rik
--
Virtual memory is like a game you can't win;
However, without VM there's truly nothing to lose...

http://www.surriel.com/		http://distro.conectiva.com/

Send all your spam to aardvark@nl.linux.org (spam digging piggy)