Re: [PATCH] mm: Fix overflow check in expand_upwards()

[Helge Deller <deller@gmx.de>]

On 30.06.2017 01:02, Jörn Engel wrote:
> I believe the overflow check was correct, then got subtly broken by
> 	commit bd726c90b6b8
> 	Author: Helge Deller <deller@gmx.de>
> 	Date:   Mon Jun 19 17:34:05 2017 +0200
> 
> 	    Allow stack to grow up to address space limit
> 
> The old overflow check may have been a bit subtle and I suppose Helge
> missed its importance.
> 
> 	if (!address)
> 		return -ENOMEM;
> 
> Functionally the my check is identical to the old one.  I just hope the
> alternative form (and comment!) make it harder to miss and break things
> in a future patch.
> 
> Signed-off-by: Joern Engel <joern@logfs.org>
> ---
>  mm/mmap.c | 3 ++-
>  1 file changed, 2 insertions(+), 1 deletion(-)
> 
> diff --git a/mm/mmap.c b/mm/mmap.c
> index a5e3dcd75e79..7366f62c31f4 100644
> --- a/mm/mmap.c
> +++ b/mm/mmap.c
> @@ -2232,7 +2232,8 @@ int expand_upwards(struct vm_area_struct *vma, unsigned long address)
>  
>  	/* Guard against exceeding limits of the address space. */
>  	address &= PAGE_MASK;
> -	if (address >= TASK_SIZE)
> +	/* second check is for integer overflow */
> +	if (address >= TASK_SIZE || address + PAGE_SIZE < address)
>  		return -ENOMEM;
>  	address += PAGE_SIZE;

That overflow check is still there.
Look at the next few lines in mmap.c:

       /* Enforce stack_guard_gap */
        gap_addr = address + stack_guard_gap;

        /* Guard against overflow */
        if (gap_addr < address || gap_addr > TASK_SIZE)
                gap_addr = TASK_SIZE;

If the requested page plus the gap (=gap_addr) wraps around, then the
code will limit it to TASK_SIZE.
So, the code should already take care of all possible areas >=TASK_SIZE,
including wrap-arounds.

Did you faced a real issue?

Helge