[PATCH 2.6.5-wolk3.0-rc2] PaX security fix

Marc-Christian Petersen <[email protected]> Tue, 4 May 2004 23:49:08 +0200
Newsgroups gmane.linux.wolk.devel
Organization Working Overloaded Linux Kernel
Message-ID <200405042349.08817@WOLK>
Hi all,

PaX announced a vulnerability in their code. So if you are using the 
grsecurity addon patch, apply the attached one and you are safe again :)

ciao, Marc
pax-fix.patch (text/x-diff, 779 B)
diff -u linux-2.6.5-pax/mm/mmap.c linux-2.6.5-pax/mm/mmap.c
--- linux-2.6.5-pax/mm/mmap.c	2004-04-28 15:56:12.000000000 +0200
+++ linux-2.6.5-pax/mm/mmap.c	2004-05-01 18:29:24.286427712 +0200
@@ -900,14 +900,18 @@
 			 * Start a new search - just in case we missed
 			 * some holes.
 			 */
-			if (start_addr != TASK_UNMAPPED_BASE) {
 
 #ifdef CONFIG_PAX_RANDMMAP
-				if (current->flags & PF_PAX_RANDMMAP)
+			if (current->flags & PF_PAX_RANDMMAP) {
+				if (start_addr != TASK_UNMAPPED_BASE + mm->delta_mmap) {
 					start_addr = addr = TASK_UNMAPPED_BASE + mm->delta_mmap;
-				else
+					goto full_search;
+				}
+				return -ENOMEM;
+			} else
 #endif
 
+			if (start_addr != TASK_UNMAPPED_BASE) {
 				start_addr = addr = TASK_UNMAPPED_BASE;
 				goto full_search;
 			}