diff options
authorDavidlohr Bueso <>2018-05-25 14:47:27 -0700
committerLinus Torvalds <>2018-05-25 18:12:11 -0700
commita73ab244f0dad8fffb3291b905f73e2d3eaa7c00 (patch)
parent7a4deea1aa8bddfed4ef1b35fc2b6732563d8ad5 (diff)
Revert "ipc/shm: Fix shmat mmap nil-page protection"
Patch series "ipc/shm: shmat() fixes around nil-page". These patches fix two issues reported[1] a while back by Joe and Andrea around how shmat(2) behaves with nil-page. The first reverts a commit that it was incorrectly thought that mapping nil-page (address=0) was a no no with MAP_FIXED. This is not the case, with the exception of SHM_REMAP; which is address in the second patch. I chose two patches because it is easier to backport and it explicitly reverts bogus behaviour. Both patches ought to be in -stable and ltp testcases need updated (the added testcase around the cve can be modified to just test for SHM_RND|SHM_REMAP). [1] This patch (of 2): Commit 95e91b831f87 ("ipc/shm: Fix shmat mmap nil-page protection") worked on the idea that we should not be mapping as root addr=0 and MAP_FIXED. However, it was reported that this scenario is in fact valid, thus making the patch both bogus and breaks userspace as well. For example X11's relies on shmat(1, SHM_RND) for lowmem initialization[1]. [1] Link: Fixes: 95e91b831f87 ("ipc/shm: Fix shmat mmap nil-page protection") Signed-off-by: Davidlohr Bueso <> Reported-by: Joe Lawrence <> Reported-by: Andrea Arcangeli <> Cc: Manfred Spraul <> Cc: <> Signed-off-by: Andrew Morton <> Signed-off-by: Linus Torvalds <>
1 files changed, 2 insertions, 7 deletions
diff --git a/ipc/shm.c b/ipc/shm.c
index 3cf4898..930be3a 100644
--- a/ipc/shm.c
+++ b/ipc/shm.c
@@ -1363,13 +1363,8 @@ long do_shmat(int shmid, char __user *shmaddr, int shmflg,
if (addr) {
if (addr & (shmlba - 1)) {
- /*
- * Round down to the nearest multiple of shmlba.
- * For sane do_mmap_pgoff() parameters, avoid
- * round downs that trigger nil-page and MAP_FIXED.
- */
- if ((shmflg & SHM_RND) && addr >= shmlba)
- addr &= ~(shmlba - 1);
+ if (shmflg & SHM_RND)
+ addr &= ~(shmlba - 1); /* round down */
if (addr & ~PAGE_MASK)
OpenPOWER on IntegriCloud