mm: madvise(): correct return code

The posix_madvise() function succeeds (and does nothing) when called with
parameters (NULL, 0, -1); according to LSB tests, it should fail with
EINVAL because -1 is not a valid flag.

When called with a valid address and size, it correctly fails.

So perform an initial check for valid flags first.

Reported-by: Jiri Dluhos <jdluhos@novell.com>
Signed-off-by: Nick Piggin <npiggin@suse.de>
Reviewed-and-Tested-by: WANG Cong <xiyou.wangcong@gmail.com>
Cc: Michael Kerrisk <mtk.manpages@googlemail.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

diff --git a/mm/madvise.c b/mm/madvise.c
index e994dcb479d6126719d49a9f7a04b0511d3cef0c..76eb4193acddb2e739b1e42a0a8371b59464f39f 100644 (file)
--- a/mm/madvise.c
+++ b/mm/madvise.c
@@ -238,12 +238,30 @@ madvise_vma(struct vm_area_struct *vma, struct vm_area_struct **prev,
                break;
 
        default:
-               error = -EINVAL;
+               BUG();
                break;
        }
        return error;
 }
 
+static int
+madvise_behavior_valid(int behavior)
+{
+       switch (behavior) {
+       case MADV_DOFORK:
+       case MADV_DONTFORK:
+       case MADV_NORMAL:
+       case MADV_SEQUENTIAL:
+       case MADV_RANDOM:
+       case MADV_REMOVE:
+       case MADV_WILLNEED:
+       case MADV_DONTNEED:
+               return 1;
+
+       default:
+               return 0;
+       }
+}
 /*
  * The madvise(2) system call.
  *
@@ -289,6 +307,9 @@ SYSCALL_DEFINE3(madvise, unsigned long, start, size_t, len_in, int, behavior)
        int write;
        size_t len;
 
+       if (!madvise_behavior_valid(behavior))
+               return error;
+
        write = madvise_need_mmap_write(behavior);
        if (write)
                down_write(&current->mm->mmap_sem);