mm: mremap: validate input before taking lock

[karo-tx-linux.git] / mm / mremap.c

diff --git a/mm/mremap.c b/mm/mremap.c
index 3708655378e9298b52ca34a204df48507aa954d2..457d34ef3bf2fd6000e74d778270d5a02a4bb6e9 100644 (file)
--- a/mm/mremap.c
+++ b/mm/mremap.c
@@ -456,13 +456,14 @@ SYSCALL_DEFINE5(mremap, unsigned long, addr, unsigned long, old_len,
        unsigned long charged = 0;
        bool locked = false;
 
-       down_write(&current->mm->mmap_sem);
-
        if (flags & ~(MREMAP_FIXED | MREMAP_MAYMOVE))
-               goto out;
+               return ret;
+
+       if (flags & MREMAP_FIXED && !(flags & MREMAP_MAYMOVE))
+               return ret;
 
        if (addr & ~PAGE_MASK)
-               goto out;
+               return ret;
 
        old_len = PAGE_ALIGN(old_len);
        new_len = PAGE_ALIGN(new_len);
@@ -473,12 +474,13 @@ SYSCALL_DEFINE5(mremap, unsigned long, addr, unsigned long, old_len,
         * a zero new-len is nonsensical.
         */
        if (!new_len)
-               goto out;
+               return ret;
+
+       down_write(&current->mm->mmap_sem);
 
        if (flags & MREMAP_FIXED) {
-               if (flags & MREMAP_MAYMOVE)
-                       ret = mremap_to(addr, old_len, new_addr, new_len,
-                                       &locked);
+               ret = mremap_to(addr, old_len, new_addr, new_len,
+                               &locked);
                goto out;
        }