linux-toradex.git/mm/mremap.c, branch v2.6.33.14

mm: avoid wrapping vm_pgoff in mremap()

2011-04-14T23:52:59+00:00

commit 982134ba62618c2d69fbbbd166d0a11ee3b7e3d8 upstream.

The normal mmap paths all avoid creating a mapping where the pgoff
inside the mapping could wrap around due to overflow.  However, an
expanding mremap() can take such a non-wrapping mapping and make it
bigger and cause a wrapping condition.

Noticed by Robert Swiecki when running a system call fuzzer, where it
caused a BUG_ON() due to terminally confusing the vma_prio_tree code.  A
vma dumping patch by Hugh then pinpointed the crazy wrapped case.

Reported-and-tested-by: Robert Swiecki 
Acked-by: Hugh Dickins 
Signed-off-by: Linus Torvalds 
Signed-off-by: Greg Kroah-Hartman

mm: fix possible cause of a page_mapped BUG

2011-03-21T19:45:31+00:00

commit a3e8cc643d22d2c8ed36b9be7d9c9ca21efcf7f7 upstream.

Robert Swiecki reported a BUG_ON(page_mapped) from a fuzzer, punching
a hole with madvise(,, MADV_REMOVE).  That path is under mutex, and
cannot be explained by lack of serialization in unmap_mapping_range().

Reviewing the code, I found one place where vm_truncate_count handling
should have been updated, when I switched at the last minute from one
way of managing the restart_addr to another: mremap move changes the
virtual addresses, so it ought to adjust the restart_addr.

But rather than exporting the notion of restart_addr from memory.c, or
converting to restart_pgoff throughout, simply reset vm_truncate_count
to 0 to force a rescan if mremap move races with preempted truncation.

We have no confirmation that this fixes Robert's BUG,
but it is a fix that's worth making anyway.

Signed-off-by: Hugh Dickins 
Signed-off-by: Linus Torvalds 
Cc: Kerin Millar 
Signed-off-by: Greg Kroah-Hartman

Take arch_mmap_check() into get_unmapped_area()

2009-12-11T11:44:58+00:00

Acked-by: Hugh Dickins 
Signed-off-by: Al Viro

fix pgoff in "have to relocate" case of mremap()

2009-12-11T11:30:23+00:00

Acked-by: Hugh Dickins 
Signed-off-by: Al Viro

fix the arch checks in MREMAP_FIXED case

2009-12-11T11:30:23+00:00

Acked-by: Russell King 
Acked-by: Hugh Dickins 
Signed-off-by: Al Viro

fix checks for expand-in-place mremap

2009-12-11T11:30:23+00:00

Acked-by: Russell King 
Signed-off-by: Al Viro

do_mremap() untangling, part 3

2009-12-11T11:30:22+00:00

Take the check for being able to expand vma in place into a separate
helper.

Acked-by: Russell King 
Acked-by: Hugh Dickins 
Signed-off-by: Al Viro

do_mremap() untangling, part 2

2009-12-11T11:30:22+00:00

Take the MREMAP_FIXED into a separate helper, simplify the living
hell out of conditions in both cases.

Acked-by: Russell King 
Acked-by: Hugh Dickins 
Signed-off-by: Al Viro

untangling do_mremap(), part 1

2009-12-11T11:30:22+00:00

Take locating vma and checks on it to a separate helper (it will be
shared between MREMAP_FIXED/non-MREMAP_FIXED cases when we split
them in the next patch)

Acked-by: Russell King 
Acked-by: Hugh Dickins 
Signed-off-by: Al Viro

truncate: new helpers

2009-09-24T12:41:47+00:00

Introduce new truncate helpers truncate_pagecache and inode_newsize_ok.
vmtruncate is also consolidated from mm/memory.c and mm/nommu.c and
into mm/truncate.c.

Reviewed-by: Christoph Hellwig 
Signed-off-by: Nick Piggin 
Signed-off-by: Al Viro