diff options
| author | Hajime Tazaki <thehajime@gmail.com> | 2026-07-02 10:28:30 +0900 |
|---|---|---|
| committer | Andrew Morton <akpm@linux-foundation.org> | 2026-07-30 19:40:49 -0700 |
| commit | 6251d650f4e71c07801015e460f930ccc034b652 (patch) | |
| tree | 190b1bf91f60d3c685c6ea147f7cd9a0443c7770 | |
| parent | 74183a956dec832723b411ed8497f58d1fc84fec (diff) | |
mm: nommu: add sysctl_max_map_count() check for do_mmap()
The sysctl variable vm.max_map_count (sysctl_max_map_count) is not exposed
under !MMU configurations, but its default value (DEFAULT_MAX_MAP_COUNT)
is still used as a allocation limit. Currently, this limit is enforced
when a VMA entry is split into two chunks (split_vma()), but it is not
checked during initial allocation (do_mmap()). As a result, if a user
requests a large number of memory allocations, the system will continue
allocating until it hits an Out-Of-Memory (OOM) condition.
This commit introduces a check at the beginning of do_mmap() in nommu.c to
prevent this situation.
This issue was detected using the Linux Test Project (LTP) test linked
below.
Link: https://github.com/linux-test-project/ltp/blob/master/testcases/kernel/syscalls/munmap/munmap04.c
Link: https://lore.kernel.org/20260702012830.667205-1-thehajime@gmail.com
Signed-off-by: Hajime Tazaki <thehajime@gmail.com>
Cc: Jann Horn <jannh@google.com>
Cc: Liam R. Howlett <liam@infradead.org>
Cc: Lorenzo Stoakes <ljs@kernel.org>
Cc: Pedro Falcato <pfalcato@suse.de>
Cc: Vlastimil Babka <vbabka@kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
| -rw-r--r-- | mm/nommu.c | 3 |
1 files changed, 3 insertions, 0 deletions
diff --git a/mm/nommu.c b/mm/nommu.c index ed3934bc2de4..11fd558be5ed 100644 --- a/mm/nommu.c +++ b/mm/nommu.c @@ -1035,6 +1035,9 @@ unsigned long do_mmap(struct file *file, if (ret < 0) return ret; + if (current->mm->map_count >= get_sysctl_max_map_count()) + return -ENOMEM; + /* we ignore the address hint */ addr = 0; len = PAGE_ALIGN(len); |