Fix get_unmapped_area sanity tests

As noted by Chris Wright, we need to do the full range of tests regardless
of whether MAP_FIXED is set or not, so re-organize get_unmapped_area()
slightly to do the sanity checks unconditionally.

1 files changed, 31 insertions, 28 deletions

diff --git a/mm/mmap.c b/mm/mmap.c
index 63df2d698414..de54acd9942f 100644
--- a/mm/mmap.c
+++ b/mm/mmap.c
@@ -1302,37 +1302,40 @@ unsigned long
 get_unmapped_area(struct file *file, unsigned long addr, unsigned long len,
                 unsigned long pgoff, unsigned long flags)
 {
-        if (flags & MAP_FIXED) {
-                unsigned long ret;
+        unsigned long ret;
 
-                if (addr > TASK_SIZE - len)
-                        return -ENOMEM;
-                if (addr & ~PAGE_MASK)
-                        return -EINVAL;
-                if (file && is_file_hugepages(file))  {
-                        /*
-                         * Check if the given range is hugepage aligned, and
-                         * can be made suitable for hugepages.
-                         */
-                        ret = prepare_hugepage_range(addr, len);
-                } else {
-                        /*
-                         * Ensure that a normal request is not falling in a
-                         * reserved hugepage range.  For some archs like IA-64,
-                         * there is a separate region for hugepages.
-                         */
-                        ret = is_hugepage_only_range(current->mm, addr, len);
-                }
-                if (ret)
-                        return -EINVAL;
-                return addr;
-        }
+        if (!(flags & MAP_FIXED)) {
+                unsigned long (*get_area)(struct file *, unsigned long, unsigned long, unsigned long, unsigned long);
 
-        if (file && file->f_op && file->f_op->get_unmapped_area)
-                return file->f_op->get_unmapped_area(file, addr, len,
-                                                pgoff, flags);
+                get_area = current->mm->get_unmapped_area;
+                if (file && file->f_op && file->f_op->get_unmapped_area)
+                        get_area = file->f_op->get_unmapped_area;
+                addr = get_area(file, addr, len, pgoff, flags);
+                if (IS_ERR_VALUE(addr))
+                        return addr;
+        }
 
-        return current->mm->get_unmapped_area(file, addr, len, pgoff, flags);
+        if (addr > TASK_SIZE - len)
+                return -ENOMEM;
+        if (addr & ~PAGE_MASK)
+                return -EINVAL;
+        if (file && is_file_hugepages(file))  {
+                /*
+                 * Check if the given range is hugepage aligned, and
+                 * can be made suitable for hugepages.
+                 */
+                ret = prepare_hugepage_range(addr, len);
+        } else {
+                /*
+                 * Ensure that a normal request is not falling in a
+                 * reserved hugepage range.  For some archs like IA-64,
+                 * there is a separate region for hugepages.
+                 */
+                ret = is_hugepage_only_range(current->mm, addr, len);
+        }
+        if (ret)
+                return -EINVAL;
+        return addr;
 }
 
 EXPORT_SYMBOL(get_unmapped_area);