um: mm: check more comprehensively for stub changes
authorJohannes Berg <johannes.berg@intel.com>
Wed, 13 Jan 2021 21:08:02 +0000 (22:08 +0100)
committerRichard Weinberger <richard@nod.at>
Fri, 12 Feb 2021 20:31:08 +0000 (21:31 +0100)
commit47da29763ec9a153b9b685bff9db659e4e09e494
tree05481f2a307bd8f7b5ded345b24c196dbf883302
parente1e22d0d9183aaaf65acf0cb529cb51ddbc12e08
um: mm: check more comprehensively for stub changes

If userspace tries to change the stub, we need to kill it,
because otherwise it can escape the virtual machine. In a
few cases the stub checks weren't good, e.g. if userspace
just tries to

mmap(0x100000 - 0x1000, 0x3000, ...)

it could succeed to get a new private/anonymous mapping
replacing the stubs. Fix this by checking everywhere, and
checking for _overlap_, not just direct changes.

Cc: stable@vger.kernel.org
Fixes: 3963333fe676 ("uml: cover stubs with a VMA")
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Richard Weinberger <richard@nod.at>
arch/um/kernel/tlb.c