The mremap syscall is supposed to return a pointer to the new virtual
memory area on success, and a negative value of the error code in case
of failure. Currently, EFAULT is returned when the VMA is not found,
instead of -EFAULT. The users of this syscall will therefore believe
the syscall succeeded in case the VMA didn't exist, as it returns a
pointer to address 0xe (0xe being the value of EFAULT).
This can easily be reproduced by the following C program. I expected
mremap to fail, but it does not. If the bug is present, it will print
0xe, otherwise the mremap will fail.
The patchset contains two patches: one that fixes the error, and
one that adds a small test case.
#define _GNU_SOURCE
#include <sys/mman.h>
#include <stdio.h>
int main() {
// Get pointer that's definitely not mapped
void* ptr = mmap(NULL, 4096, PROT_READ, MAP_PRIVATE | MAP_ANONYMOUS, -1, 0);
if (ptr == MAP_FAILED) { perror("mmap"); return 1; }
int err = munmap(ptr, 4096);
if (err < 0) { perror("munmap"); return 1; }
// Remap unexisting VMA
ptr = mremap(ptr, 4096, 4096, 0);
if (ptr == MAP_FAILED) { perror("mremap"); return 1; }
printf("%p\n", ptr);
return 0;
}
Niels Dossche (2):
mm: mremap: fix sign for EFAULT error return value
selftest/vm: test that mremap fails on non-existent vma
mm/mremap.c | 2 +-
tools/testing/selftests/vm/hugepage-mremap.c | 6 ++++++
2 files changed, 7 insertions(+), 1 deletion(-)
--
2.35.2