um: mm: check more comprehensively for stub changes
authorJohannes Berg <johannes.berg@intel.com>
Wed, 13 Jan 2021 21:08:02 +0000 (22:08 +0100)
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Thu, 4 Mar 2021 10:38:42 +0000 (11:38 +0100)
commit63a069b81d40b7684e959f1073cf5eae2f812c5a
treefd0d5f62a6b66e26939a1c0b689c91589550259c
parent68a6199cf334b21c86961c87fc1848b1923a9ebb
um: mm: check more comprehensively for stub changes

commit 47da29763ec9a153b9b685bff9db659e4e09e494 upstream.

If userspace tries to change the stub, we need to kill it,
because otherwise it can escape the virtual machine. In a
few cases the stub checks weren't good, e.g. if userspace
just tries to

mmap(0x100000 - 0x1000, 0x3000, ...)

it could succeed to get a new private/anonymous mapping
replacing the stubs. Fix this by checking everywhere, and
checking for _overlap_, not just direct changes.

Cc: stable@vger.kernel.org
Fixes: 3963333fe676 ("uml: cover stubs with a VMA")
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Richard Weinberger <richard@nod.at>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
arch/um/kernel/tlb.c