ARM: prevent VM_GROWSDOWN mmaps extending below FIRST_USER_ADDRESS

commit 9b61a4d1b2064dbd0c9e61754305ac852170509f upstream.

Reported-by: Al Viro <viro@zeniv.linux.org.uk>
Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk>
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>

diff --git a/arch/arm/mm/fault.c b/arch/arm/mm/fault.c
index aa33949fef608cb4c5b7b9a76e0f4020ba0f1db6..4b0bc37b943d9a81b5b5a63264007739defccee7 100644 (file)
--- a/arch/arm/mm/fault.c
+++ b/arch/arm/mm/fault.c
@@ -267,7 +267,9 @@ good_area:
        return fault;
 
 check_stack:
-       if (vma->vm_flags & VM_GROWSDOWN && !expand_stack(vma, addr))
+       /* Don't allow expansion below FIRST_USER_ADDRESS */
+       if (vma->vm_flags & VM_GROWSDOWN &&
+           addr >= FIRST_USER_ADDRESS && !expand_stack(vma, addr))
                goto good_area;
 out:
        return fault;