Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20;
From:   Niels Dossche <dossche.niels@gmail.com>
To:     Andrew Morton <akpm@linux-foundation.org>
Cc:     linux-mm@kvack.org, linux-kernel@vger.kernel.org,
        Mina Almasry <almasrymina@google.com>,
        Niels Dossche <dossche.niels@gmail.com>
Subject: [PATCH 0/2] mm: mremap: fix sign for EFAULT error return value
Date:   Thu, 28 Apr 2022 00:44:37 +0200
Message-Id: <20220427224439.23828-1-dossche.niels@gmail.com>
MIME-Version: 1.0
Content-Transfer-Encoding: 8bit
Precedence: bulk

The mremap syscall is supposed to return a pointer to the new virtual
memory area on success, and a negative value of the error code in case
of failure. Currently, EFAULT is returned when the VMA is not found,
instead of -EFAULT. The users of this syscall will therefore believe
the syscall succeeded in case the VMA didn't exist, as it returns a
pointer to address 0xe (0xe being the value of EFAULT).

This can easily be reproduced by the following C program. I expected
mremap to fail, but it does not. If the bug is present, it will print
0xe, otherwise the mremap will fail.

The patchset contains two patches: one that fixes the error, and
one that adds a small test case.


#define _GNU_SOURCE
#include <sys/mman.h>
#include <stdio.h>
int main() {
	// Get pointer that's definitely not mapped
	void* ptr = mmap(NULL, 4096, PROT_READ, MAP_PRIVATE | MAP_ANONYMOUS, -1, 0);
	if (ptr == MAP_FAILED) { perror("mmap"); return 1; }
	int err = munmap(ptr, 4096);
	if (err < 0) { perror("munmap"); return 1; }
	// Remap unexisting VMA
	ptr = mremap(ptr, 4096, 4096, 0);
	if (ptr == MAP_FAILED) { perror("mremap"); return 1; }
	printf("%p\n", ptr);
	return 0;
}


Niels Dossche (2):
  mm: mremap: fix sign for EFAULT error return value
  selftest/vm: test that mremap fails on non-existent vma

 mm/mremap.c                                  | 2 +-
 tools/testing/selftests/vm/hugepage-mremap.c | 6 ++++++
 2 files changed, 7 insertions(+), 1 deletion(-)

-- 
2.35.2