summaryrefslogtreecommitdiff
path: root/ipc
diff options
context:
space:
mode:
authorOleg Nesterov <oleg@redhat.com>2014-10-13 15:54:12 -0700
committerLinus Torvalds <torvalds@linux-foundation.org>2014-10-14 02:18:23 +0200
commitbf77b94c99ad5df0d97a52522fc7a220c0bf44fe (patch)
treefbf5579029160ae086b0ae16ed25ab9814550dbd /ipc
parent1195d94e006b23c6292e78857e154872e33b6d7e (diff)
ipc/shm: kill the historical/wrong mm->start_stack check
do_shmat() is the only user of ->start_stack (proc just reports its value), and this check looks ugly and wrong. The reason for this check is not clear at all, and it wrongly assumes that the stack can only grow down. But the main problem is that in general mm->start_stack has nothing to do with stack_vma->vm_start. Not only the application can switch to another stack and even unmap this area, setup_arg_pages() expands the stack without updating mm->start_stack during exec(). This means that in the likely case "addr > start_stack - size - PAGE_SIZE * 5" is simply impossible after find_vma_intersection() == F, or the stack can't grow anyway because of RLIMIT_STACK. Many thanks to Hugh for his explanations. Signed-off-by: Oleg Nesterov <oleg@redhat.com> Acked-by: Hugh Dickins <hughd@google.com> Cc: Cyrill Gorcunov <gorcunov@gmail.com> Cc: Davidlohr Bueso <davidlohr.bueso@hp.com> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Diffstat (limited to 'ipc')
-rw-r--r--ipc/shm.c7
1 files changed, 0 insertions, 7 deletions
diff --git a/ipc/shm.c b/ipc/shm.c
index 7fc9f9f3a26b..01454796ba3c 100644
--- a/ipc/shm.c
+++ b/ipc/shm.c
@@ -1172,13 +1172,6 @@ long do_shmat(int shmid, char __user *shmaddr, int shmflg, ulong *raddr,
if (find_vma_intersection(current->mm, addr, addr + size))
goto invalid;
- /*
- * If shm segment goes below stack, make sure there is some
- * space left for the stack to grow (at least 4 pages).
- */
- if (addr < current->mm->start_stack &&
- addr > current->mm->start_stack - size - PAGE_SIZE * 5)
- goto invalid;
}
addr = do_mmap_pgoff(file, addr, size, prot, flags, 0, &populate);