tree 05481f2a307bd8f7b5ded345b24c196dbf883302
parent e1e22d0d9183aaaf65acf0cb529cb51ddbc12e08
author Johannes Berg <johannes.berg@intel.com> 1610572082 +0100
committer Richard Weinberger <richard@nod.at> 1613161868 +0100

um: mm: check more comprehensively for stub changes

If userspace tries to change the stub, we need to kill it,
because otherwise it can escape the virtual machine. In a
few cases the stub checks weren't good, e.g. if userspace
just tries to

	mmap(0x100000 - 0x1000, 0x3000, ...)

it could succeed to get a new private/anonymous mapping
replacing the stubs. Fix this by checking everywhere, and
checking for _overlap_, not just direct changes.

Cc: stable@vger.kernel.org
Fixes: 3963333fe676 ("uml: cover stubs with a VMA")
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Richard Weinberger <richard@nod.at>