linux/include
David Howells 7e6608724c nommu: fix shared mmap after truncate shrinkage problems
Fix a problem in NOMMU mmap with ramfs whereby a shared mmap can happen
over the end of a truncation.  The problem is that
ramfs_nommu_check_mappings() checks that the reduced file size against the
VMA tree, but not the vm_region tree.

The following sequence of events can cause the problem:

	fd = open("/tmp/x", O_RDWR|O_TRUNC|O_CREAT, 0600);
	ftruncate(fd, 32 * 1024);
	a = mmap(NULL, 32 * 1024, PROT_READ|PROT_WRITE, MAP_SHARED, fd, 0);
	b = mmap(NULL, 16 * 1024, PROT_READ|PROT_WRITE, MAP_SHARED, fd, 0);
	munmap(a, 32 * 1024);
	ftruncate(fd, 16 * 1024);
	c = mmap(NULL, 32 * 1024, PROT_READ|PROT_WRITE, MAP_SHARED, fd, 0);

Mapping 'a' creates a vm_region covering 32KB of the file.  Mapping 'b'
sees that the vm_region from 'a' is covering the region it wants and so
shares it, pinning it in memory.

Mapping 'a' then goes away and the file is truncated to the end of VMA
'b'.  However, the region allocated by 'a' is still in effect, and has
_not_ been reduced.

Mapping 'c' is then created, and because there's a vm_region covering the
desired region, get_unmapped_area() is _not_ called to repeat the check,
and the mapping is granted, even though the pages from the latter half of
the mapping have been discarded.

However:

	d = mmap(NULL, 16 * 1024, PROT_READ|PROT_WRITE, MAP_SHARED, fd, 0);

Mapping 'd' should work, and should end up sharing the region allocated by
'a'.

To deal with this, we shrink the vm_region struct during the truncation,
lest do_mmap_pgoff() take it as licence to share the full region
automatically without calling the get_unmapped_area() file op again.

Signed-off-by: David Howells <dhowells@redhat.com>
Acked-by: Al Viro <viro@zeniv.linux.org.uk>
Cc: Greg Ungerer <gerg@snapgear.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
2010-01-16 12:15:40 -08:00
..
acpi ACPI: processor: remove _PDC object list from struct acpi_processor 2009-12-22 03:35:16 -05:00
asm-generic fix up O_SYNC comments 2009-12-17 11:03:24 -05:00
crypto crypto: hash - Remove legacy hash/digest code 2009-10-19 12:53:37 +09:00
drm Merge branch 'drm-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/airlied/drm-2.6 2010-01-11 09:46:20 -08:00
keys
linux nommu: fix shared mmap after truncate shrinkage problems 2010-01-16 12:15:40 -08:00
math-emu
media V4L/DVB (13670): soc-camera: Add mt9t112 camera driver 2009-12-16 09:27:41 -02:00
mtd
net Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-2.6 2010-01-14 08:36:15 -08:00
pcmcia pcmcia: CodingStyle fixes 2009-12-07 22:23:40 +01:00
rdma Merge branches 'amso1100', 'cma', 'cxgb3', 'ehca', 'ipath', 'ipoib', 'iser', 'misc', 'mlx4' and 'nes' into for-next 2009-12-15 23:39:25 -08:00
rxrpc
scsi libsrp: fix compile failure 2009-12-30 12:23:27 -08:00
sound Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jikos/trivial 2009-12-09 19:43:33 -08:00
trace tracing: Fix sign fields in ftrace_define_fields_##call() 2009-12-30 10:27:06 -05:00
video Merge git://git.kernel.org/pub/scm/linux/kernel/git/lethal/sh-2.6 2009-12-16 10:29:52 -08:00
xen xen: move Xen-testing predicates to common header 2009-11-04 08:47:24 -08:00
Kbuild