We received the following report via vendor-sec.
The issue is public.

Date: Thu, 19 May 2005 18:46:00 -0700
From: Chris Wright <chrisw@osdl.org>
To: vendor-sec@lst.de
Subject: [vendor-sec] [torvalds@osdl.org: Re: [Security] more possible mmap topdown trouble]

When looking at the mmap topdown allocator, I found one could create
illegal maps with vm_start > vm_end (and vm_start in kernel space).
With a large stack rlimit and a large allocation request mmap_base-len
can overflow.  I didn't try to use this for priv. escalation (not sure if
it's possible or not), but I could certainly trigger Oopsen and panics.
Below is the patch Linus is planning on applying, it's generic in
get_unmapped_area to do sanity checking on the return from the arch,
or process, or file specific get_unmapped_area function.  At this point
it's being treated as local DoS.

Here's some examples out mappings I created with the simple attached
program.

$ ./mmap_topdown -l 0x40000000 -s
dff80000-1ff80000 rw-p dff80000 00:00 0
$ ./mmap_topdown -l 0x50000000 -s
cfffa000-1fffa000 rw-p cfffa000 00:00 0
$ ./mmap_topdown -l 0x60000000 -s
bff7e000-1ff7e000 rw-p bff7e000 00:00 0

thanks,
-chris

----- Forwarded message from Linus Torvalds <torvalds@osdl.org> -----

Date: Thu, 19 May 2005 17:38:20 -0700 (PDT)
From: Linus Torvalds <torvalds@osdl.org>
To: Chris Wright <chrisw@osdl.org>
cc: security@kernel.org
Subject: Re: [Security] more possible mmap topdown trouble

On Thu, 19 May 2005, Chris Wright wrote:
> 
> Yeah, sorry, I meant bang on your patch.  So far, so good (in fact the
> small bit above is insufficient because it doesn't catch the general case
> of vm_start > vm_end, whereas your patch does).

Here's an improved version, that allows the "get_area()" function to
return some other error code than just -EINVAL. My original patch would
just always make some get_area() specific error code be converted into
-EINVAL. 

The only difference here is the non-fixed case addition of

	if (addr > (unsigned long)-1000L)
		return addr;

along with the comment that goes with it.

As usual, I'm inclined to apply this fairly soon..

		Linus

----
diff --git a/mm/mmap.c b/mm/mmap.c
--- a/mm/mmap.c
+++ b/mm/mmap.c
@@ -1302,37 +1302,48 @@ unsigned long
 get_unmapped_area(struct file *file, unsigned long addr, unsigned long len,
 		unsigned long pgoff, unsigned long flags)
 {
-	if (flags & MAP_FIXED) {
-		unsigned long ret;
+	unsigned long ret;
 
-		if (addr > TASK_SIZE - len)
-			return -ENOMEM;
-		if (addr & ~PAGE_MASK)
-			return -EINVAL;
-		if (file && is_file_hugepages(file))  {
-			/*
-			 * Check if the given range is hugepage aligned, and
-			 * can be made suitable for hugepages.
-			 */
-			ret = prepare_hugepage_range(addr, len);
-		} else {
-			/*
-			 * Ensure that a normal request is not falling in a
-			 * reserved hugepage range.  For some archs like IA-64,
-			 * there is a separate region for hugepages.
-			 */
-			ret = is_hugepage_only_range(current->mm, addr, len);
-		}
-		if (ret)
-			return -EINVAL;
-		return addr;
-	}
+	if (!(flags & MAP_FIXED)) {
+		unsigned long (*get_area)(struct file *, unsigned long, unsigned long, unsigned long, unsigned long);
 
-	if (file && file->f_op && file->f_op->get_unmapped_area)
-		return file->f_op->get_unmapped_area(file, addr, len,
-						pgoff, flags);
+		get_area = current->mm->get_unmapped_area;
+		if (file && file->f_op && file->f_op->get_unmapped_area)
+			get_area = file->f_op->get_unmapped_area;
+		addr = get_area(file, addr, len, pgoff, flags);
 
-	return current->mm->get_unmapped_area(file, addr, len, pgoff, flags);
+		/*
+		 * We allow returning either an error number or an addresses,
+		 * and the "-1000L" magic constant is the same thing we use
+		 * inside err.h: IS_ERR(). We should probably abstract this
+		 * better, especially since some day we may end up having to
+		 * make this architecture-dependent...
+		 */
+		if (addr > (unsigned long)-1000L)
+			return addr;
+	}
+
+	if (addr > TASK_SIZE - len)
+		return -ENOMEM;
+	if (addr & ~PAGE_MASK)
+		return -EINVAL;
+	if (file && is_file_hugepages(file))  {
+		/*
+		 * Check if the given range is hugepage aligned, and
+		 * can be made suitable for hugepages.
+		 */
+		ret = prepare_hugepage_range(addr, len);
+	} else {
+		/*
+		 * Ensure that a normal request is not falling in a
+		 * reserved hugepage range.  For some archs like IA-64,
+		 * there is a separate region for hugepages.
+		 */
+		ret = is_hugepage_only_range(current->mm, addr, len);
+	}
+	if (ret)
+		return -EINVAL;
+	return addr;
 }
 
 EXPORT_SYMBOL(get_unmapped_area);

----- End forwarded message -----