summaryrefslogtreecommitdiff
path: root/mm
diff options
context:
space:
mode:
authorLinus Torvalds <torvalds@linux-foundation.org>2011-04-13 08:07:28 -0700
committerLinus Torvalds <torvalds@linux-foundation.org>2011-04-13 08:07:28 -0700
commita626ca6a656450e9f4df91d0dda238fff23285f4 (patch)
tree7de7fabc83baf1312805d9b5f28f01d1adf3f7fd /mm
parent60d48c1e67dc8de0676453de18adba1768fb6fab (diff)
downloadlinux-3.10-a626ca6a656450e9f4df91d0dda238fff23285f4.tar.gz
linux-3.10-a626ca6a656450e9f4df91d0dda238fff23285f4.tar.bz2
linux-3.10-a626ca6a656450e9f4df91d0dda238fff23285f4.zip
vm: fix vm_pgoff wrap in stack expansion
Commit 982134ba6261 ("mm: avoid wrapping vm_pgoff in mremap()") fixed the case of a expanding mapping causing vm_pgoff wrapping when you used mremap. But there was another case where we expand mappings hiding in plain sight: the automatic stack expansion. This fixes that case too. This one also found by Robert Święcki, using his nasty system call fuzzer tool. Good job. Reported-and-tested-by: Robert Święcki <robert@swiecki.net> Cc: stable@kernel.org Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Diffstat (limited to 'mm')
-rw-r--r--mm/mmap.c13
1 files changed, 8 insertions, 5 deletions
diff --git a/mm/mmap.c b/mm/mmap.c
index 2ec8eb5a9cd..8c05e5b43b6 100644
--- a/mm/mmap.c
+++ b/mm/mmap.c
@@ -1814,11 +1814,14 @@ static int expand_downwards(struct vm_area_struct *vma,
size = vma->vm_end - address;
grow = (vma->vm_start - address) >> PAGE_SHIFT;
- error = acct_stack_growth(vma, size, grow);
- if (!error) {
- vma->vm_start = address;
- vma->vm_pgoff -= grow;
- perf_event_mmap(vma);
+ error = -ENOMEM;
+ if (grow <= vma->vm_pgoff) {
+ error = acct_stack_growth(vma, size, grow);
+ if (!error) {
+ vma->vm_start = address;
+ vma->vm_pgoff -= grow;
+ perf_event_mmap(vma);
+ }
}
}
vma_unlock_anon_vma(vma);