From: Alexei Starovoitov The first mmap() of an arena sets user_vm_start and user_vm_end. Each subsequent mmap() must use the same range. The value 0 in user_vm_start means that the range is not set, but a mapping can start at address 0. Then arena_map_mmap() does not check vm_start and sets user_vm_start again. The range tree counts pages from user_vm_start. With a new user_vm_start it reports allocated pages as free, and apply_range_set_cb() fails with -EBUSY. An arena at address 0 is not useful, because the verifier rejects all progs that refer to it. Return -EINVAL from arena_get_unmapped_area(). It runs before mmap() removes the old mappings in the range. Fixes: 317460317a02 ("bpf: Introduce bpf_arena.") Signed-off-by: Alexei Starovoitov --- kernel/bpf/arena.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/kernel/bpf/arena.c b/kernel/bpf/arena.c index 3c61c181a6fa..ad8aab551093 100644 --- a/kernel/bpf/arena.c +++ b/kernel/bpf/arena.c @@ -650,6 +650,9 @@ static unsigned long arena_get_unmapped_area(struct file *filp, unsigned long ad ret = mm_get_unmapped_area(filp, addr, len * 2, 0, flags); if (IS_ERR_VALUE(ret)) return ret; + if (!ret) + /* user_vm_start == 0 means that the user range is not set yet */ + return -EINVAL; if ((ret >> 32) == ((ret + len - 1) >> 32)) return ret; if (WARN_ON_ONCE(arena->user_vm_start)) -- 2.55.0