3 files changed, 14 insertions, 5 deletions

diff --git a/mm/mmap.c b/mm/mmap.c
index 906ed402f7ca..9f70c8e8c871 100644
--- a/mm/mmap.c
+++ b/mm/mmap.c
@@ -1023,10 +1023,10 @@ unsigned long do_mmap_pgoff(struct file * file, unsigned long addr,
                 }
         }
 
-        error = security_file_mmap(file, reqprot, prot, flags);
+        error = security_file_mmap(file, reqprot, prot, flags, addr, 0);
         if (error)
                 return error;
-                
+
         /* Clear old maps */
         error = -ENOMEM;
 munmap_back:
diff --git a/mm/mremap.c b/mm/mremap.c
index 5d4bd4f95b8e..bc7c52efc71b 100644
--- a/mm/mremap.c
+++ b/mm/mremap.c
@@ -291,6 +291,10 @@ unsigned long do_mremap(unsigned long addr,
                 if ((addr <= new_addr) && (addr+old_len) > new_addr)
                         goto out;
 
+                ret = security_file_mmap(0, 0, 0, 0, new_addr, 1);
+                if (ret)
+                        goto out;
+
                 ret = do_munmap(mm, new_addr, new_len);
                 if (ret)
                         goto out;
@@ -390,8 +394,13 @@ unsigned long do_mremap(unsigned long addr,
 
                         new_addr = get_unmapped_area(vma->vm_file, 0, new_len,
                                                 vma->vm_pgoff, map_flags);
-                        ret = new_addr;
-                        if (new_addr & ~PAGE_MASK)
+                        if (new_addr & ~PAGE_MASK) {
+                                ret = new_addr;
+                                goto out;
+                        }
+
+                        ret = security_file_mmap(0, 0, 0, 0, new_addr, 1);
+                        if (ret)
                                 goto out;
                 }
                 ret = move_vma(vma, addr, old_len, new_len, new_addr);
diff --git a/mm/nommu.c b/mm/nommu.c
index 2b16b00a5b11..989e2e9af5c3 100644
--- a/mm/nommu.c
+++ b/mm/nommu.c
@@ -639,7 +639,7 @@ static int validate_mmap_request(struct file *file,
         }
 
         /* allow the security API to have its say */
-        ret = security_file_mmap(file, reqprot, prot, flags);
+        ret = security_file_mmap(file, reqprot, prot, flags, addr, 0);
         if (ret < 0)
                 return ret;