From: Danny Feng <dfeng@redhat.com>
Date: Fri, 29 Jan 2010 09:25:48 -0500
Subject: [mm] fix the arch checks in MREMAP_FIXED case
Message-id: <20100129092600.4587.8472.sendpatchset@dhcp-65-180.nay.redhat.com>
Patchwork-id: 22990
O-Subject: [PATCH RHEL5.5 5/12 BZ556710 CVE-2010-0291] fix the arch checks in
	MREMAP_FIXED case
Bugzilla: 556710
RH-Acked-by: Jarod Wilson <jarod@redhat.com>
RH-Acked-by: Larry Woodman <lwoodman@redhat.com>

backport of upstream commit 097eed103862f9c6a97f2e415e21d1134017b135

Subject: [PATCH] fix the arch checks in MREMAP_FIXED case

Acked-by: Russell King <rmk+kernel@arm.linux.org.uk>
Acked-by: Hugh Dickins <hugh.dickins@tiscali.co.uk>
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>

diff --git a/mm/mremap.c b/mm/mremap.c
index 730acee..75e9832 100644
--- a/mm/mremap.c
+++ b/mm/mremap.c
@@ -308,6 +308,7 @@ static unsigned long mremap_to(unsigned long addr,
 	struct vm_area_struct *vma;
 	unsigned long ret = -EINVAL;
 	unsigned long charged = 0;
+	unsigned long map_flags;
 
 	if (new_addr & ~PAGE_MASK)
 		goto out;
@@ -345,9 +346,23 @@ static unsigned long mremap_to(unsigned long addr,
 		goto out;
 	}
 
-	ret = move_vma(vma, addr, old_len, new_len, new_addr);
+	map_flags = MAP_FIXED;
+	if (vma->vm_flags & VM_MAYSHARE)
+		map_flags |= MAP_SHARED;
+	ret = arch_mmap_check(new_addr, new_len, map_flags);
+	if (ret)
+		goto out1;
+	ret = get_unmapped_area(vma->vm_file, new_addr, new_len, vma->vm_pgoff +
+				((addr - vma->vm_start) >> PAGE_SHIFT),
+				map_flags);
 	if (ret & ~PAGE_MASK)
-		vm_unacct_memory(charged);
+		goto out1;
+
+	ret = move_vma(vma, addr, old_len, new_len, new_addr);
+	if (!(ret & ~PAGE_MASK))
+		goto out;
+out1:
+	vm_unacct_memory(charged);
 
 out:
 	return ret;