[PATCH 0/2] mm: mremap: fix sign for EFAULT error return value

[Niels Dossche]

The mremap syscall is supposed to return a pointer to the new virtual
memory area on success, and a negative value of the error code in case
of failure. Currently, EFAULT is returned when the VMA is not found,
instead of -EFAULT. The users of this syscall will therefore believe
the syscall succeeded in case the VMA didn't exist, as it returns a
pointer to address 0xe (0xe being the value of EFAULT).

This can easily be reproduced by the following C program. I expected
mremap to fail, but it does not. If the bug is present, it will print
0xe, otherwise the mremap will fail.

The patchset contains two patches: one that fixes the error, and
one that adds a small test case.


#define _GNU_SOURCE
#include <sys/mman.h>
#include <stdio.h>
int main() {
	// Get pointer that's definitely not mapped
	void* ptr = mmap(NULL, 4096, PROT_READ, MAP_PRIVATE | MAP_ANONYMOUS, -1, 0);
	if (ptr == MAP_FAILED) { perror("mmap"); return 1; }
	int err = munmap(ptr, 4096);
	if (err < 0) { perror("munmap"); return 1; }
	// Remap unexisting VMA
	ptr = mremap(ptr, 4096, 4096, 0);
	if (ptr == MAP_FAILED) { perror("mremap"); return 1; }
	printf("%p\n", ptr);
	return 0;
}


Niels Dossche (2):
  mm: mremap: fix sign for EFAULT error return value
  selftest/vm: test that mremap fails on non-existent vma

 mm/mremap.c                                  | 2 +-
 tools/testing/selftests/vm/hugepage-mremap.c | 6 ++++++
 2 files changed, 7 insertions(+), 1 deletion(-)

-- 
2.35.2