The patch titled Subject: ipc/shm: fix shmat() nil address after round-down when remapping has been removed from the -mm tree. Its filename was ipc-shm-fix-shmat-nil-address-after-round-down-when-remapping.patch

This patch was dropped because it was merged into mainline or a subsystem tree

------------------------------------------------------ From: Davidlohr Bueso dave@stgolabs.net Subject: ipc/shm: fix shmat() nil address after round-down when remapping

shmat()'s SHM_REMAP option forbids passing a nil address for; this is in fact the very first thing we check for. Andrea reported that for SHM_RND|SHM_REMAP cases we can end up bypassing the initial addr check, but we need to check again if the address was rounded down to nil. As of this patch, such cases will return -EINVAL.

Link: http://lkml.kernel.org/r/20180503204934.kk63josdu6u53fbd@linux-n805 Signed-off-by: Davidlohr Bueso dbueso@suse.de Reported-by: Andrea Arcangeli aarcange@redhat.com Cc: Joe Lawrence joe.lawrence@redhat.com Cc: Manfred Spraul manfred@colorfullife.com Cc: stable@vger.kernel.org Signed-off-by: Andrew Morton akpm@linux-foundation.org ---

ipc/shm.c | 12 ++++++++++-- 1 file changed, 10 insertions(+), 2 deletions(-)

diff -puN ipc/shm.c~ipc-shm-fix-shmat-nil-address-after-round-down-when-remapping ipc/shm.c --- a/ipc/shm.c~ipc-shm-fix-shmat-nil-address-after-round-down-when-remapping +++ a/ipc/shm.c @@ -1363,9 +1363,17 @@ long do_shmat(int shmid, char __user *sh

if (addr) { if (addr & (shmlba - 1)) { - if (shmflg & SHM_RND) + if (shmflg & SHM_RND) { addr &= ~(shmlba - 1); /* round down */ - else + + /* + * Ensure that the round-down is non-nil + * when remapping. This can happen for + * cases when addr < shmlba. + */ + if (!addr && (shmflg & SHM_REMAP)) + goto out; + } else #ifndef __ARCH_FORCE_SHMLBA if (addr & ~PAGE_MASK) #endif _

Patches currently in -mm which might be from dave@stgolabs.net are

ipc-sem-mitigate-semnum-index-against-spectre-v1.patch