The patch titled Subject: ipc/shm: fix shmat() nil address after round-down when remapping has been added to the -mm tree. Its filename is ipc-shm-fix-shmat-nil-address-after-round-down-when-remapping.patch

This patch should soon appear at http://ozlabs.org/~akpm/mmots/broken-out/ipc-shm-fix-shmat-nil-address-after... and later at http://ozlabs.org/~akpm/mmotm/broken-out/ipc-shm-fix-shmat-nil-address-after...

Before you just go and hit "reply", please: a) Consider who else should be cc'ed b) Prefer to cc a suitable mailing list as well c) Ideally: find the original patch on the mailing list and do a reply-to-all to that, adding suitable additional cc's

*** Remember to use Documentation/process/submit-checklist.rst when testing your code ***

The -mm tree is included into linux-next and is updated there every 3-4 working days

------------------------------------------------------ From: Davidlohr Bueso dave@stgolabs.net Subject: ipc/shm: fix shmat() nil address after round-down when remapping

shmat()'s SHM_REMAP option forbids passing a nil address for; this is in fact the very first thing we check for. Andrea reported that for SHM_RND|SHM_REMAP cases we can end up bypassing the initial addr check, but we need to check again if the address was rounded down to nil. As of this patch, such cases will return -EINVAL.

Link: http://lkml.kernel.org/r/20180503204934.kk63josdu6u53fbd@linux-n805 Signed-off-by: Davidlohr Bueso dbueso@suse.de Reported-by: Andrea Arcangeli aarcange@redhat.com Cc: Joe Lawrence joe.lawrence@redhat.com Cc: Manfred Spraul manfred@colorfullife.com Cc: stable@vger.kernel.org Signed-off-by: Andrew Morton akpm@linux-foundation.org ---

ipc/shm.c | 12 ++++++++++-- 1 file changed, 10 insertions(+), 2 deletions(-)

diff -puN ipc/shm.c~ipc-shm-fix-shmat-nil-address-after-round-down-when-remapping ipc/shm.c --- a/ipc/shm.c~ipc-shm-fix-shmat-nil-address-after-round-down-when-remapping +++ a/ipc/shm.c @@ -1363,9 +1363,17 @@ long do_shmat(int shmid, char __user *sh

if (addr) { if (addr & (shmlba - 1)) { - if (shmflg & SHM_RND) + if (shmflg & SHM_RND) { addr &= ~(shmlba - 1); /* round down */ - else + + /* + * Ensure that the round-down is non-nil + * when remapping. This can happen for + * cases when addr < shmlba. + */ + if (!addr && (shmflg & SHM_REMAP)) + goto out; + } else #ifndef __ARCH_FORCE_SHMLBA if (addr & ~PAGE_MASK) #endif _

Patches currently in -mm which might be from dave@stgolabs.net are

ipc-sem-mitigate-semnum-index-against-spectre-v1.patch revert-ipc-shm-fix-shmat-mmap-nil-page-protection.patch ipc-shm-fix-shmat-nil-address-after-round-down-when-remapping.patch