Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1763752AbYBFNps (ORCPT ); Wed, 6 Feb 2008 08:45:48 -0500 Received: (majordomo@vger.kernel.org) by vger.kernel.org id S1762886AbYBFNpT (ORCPT ); Wed, 6 Feb 2008 08:45:19 -0500 Received: from styx.suse.cz ([82.119.242.94]:44709 "EHLO mail.suse.cz" rhost-flags-OK-OK-OK-FAIL) by vger.kernel.org with ESMTP id S1762835AbYBFNpR (ORCPT ); Wed, 6 Feb 2008 08:45:17 -0500 Date: Wed, 6 Feb 2008 14:45:16 +0100 (CET) From: Jiri Kosina To: Andrew Morton cc: Ingo Molnar , Arjan van de Ven , Hugh Dickins , Pavel Machek , linux-kernel@vger.kernel.org Subject: [PATCH 1/2] brk: check the lower bound properly In-Reply-To: Message-ID: References: MIME-Version: 1.0 Content-Type: TEXT/PLAIN; charset=US-ASCII Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Length: 1180 Lines: 36 From: Jiri Kosina brk: check the lower bound properly There is a check in sys_brk(), that tries to make sure that we do not underflow the area that is dedicated to brk heap. The check is however wrong, as it assumes that brk area starts immediately after the end of the code (+bss), which is wrong for example in environments with randomized brk start. The proper way is to check whether the address is not below the start_brk address. Cc: Ingo Molnar Cc: Arjan van de Ven Acked-by: Hugh Dickins Acked-by: Pavel Machek Signed-off-by: Jiri Kosina diff --git a/mm/mmap.c b/mm/mmap.c index 8295577..1c3b48f 100644 --- a/mm/mmap.c +++ b/mm/mmap.c @@ -241,7 +241,7 @@ asmlinkage unsigned long sys_brk(unsigned long brk) down_write(&mm->mmap_sem); - if (brk < mm->end_code) + if (brk < mm->start_brk) goto out; /* -- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/