1
2
3
4
5
6
7
8
9#define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
10
11#include <linux/kernel.h>
12#include <linux/slab.h>
13#include <linux/backing-dev.h>
14#include <linux/mm.h>
15#include <linux/vmacache.h>
16#include <linux/shm.h>
17#include <linux/mman.h>
18#include <linux/pagemap.h>
19#include <linux/swap.h>
20#include <linux/syscalls.h>
21#include <linux/capability.h>
22#include <linux/init.h>
23#include <linux/file.h>
24#include <linux/fs.h>
25#include <linux/personality.h>
26#include <linux/security.h>
27#include <linux/hugetlb.h>
28#include <linux/shmem_fs.h>
29#include <linux/profile.h>
30#include <linux/export.h>
31#include <linux/mount.h>
32#include <linux/mempolicy.h>
33#include <linux/rmap.h>
34#include <linux/mmu_notifier.h>
35#include <linux/mmdebug.h>
36#include <linux/perf_event.h>
37#include <linux/audit.h>
38#include <linux/khugepaged.h>
39#include <linux/uprobes.h>
40#include <linux/rbtree_augmented.h>
41#include <linux/notifier.h>
42#include <linux/memory.h>
43#include <linux/printk.h>
44#include <linux/userfaultfd_k.h>
45#include <linux/moduleparam.h>
46#include <linux/pkeys.h>
47#include <linux/oom.h>
48
49#include <linux/uaccess.h>
50#include <asm/cacheflush.h>
51#include <asm/tlb.h>
52#include <asm/mmu_context.h>
53
54#include "internal.h"
55
56#ifndef arch_mmap_check
57#define arch_mmap_check(addr, len, flags) (0)
58#endif
59
60#ifdef CONFIG_HAVE_ARCH_MMAP_RND_BITS
61const int mmap_rnd_bits_min = CONFIG_ARCH_MMAP_RND_BITS_MIN;
62const int mmap_rnd_bits_max = CONFIG_ARCH_MMAP_RND_BITS_MAX;
63int mmap_rnd_bits __read_mostly = CONFIG_ARCH_MMAP_RND_BITS;
64#endif
65#ifdef CONFIG_HAVE_ARCH_MMAP_RND_COMPAT_BITS
66const int mmap_rnd_compat_bits_min = CONFIG_ARCH_MMAP_RND_COMPAT_BITS_MIN;
67const int mmap_rnd_compat_bits_max = CONFIG_ARCH_MMAP_RND_COMPAT_BITS_MAX;
68int mmap_rnd_compat_bits __read_mostly = CONFIG_ARCH_MMAP_RND_COMPAT_BITS;
69#endif
70
71static bool ignore_rlimit_data;
72core_param(ignore_rlimit_data, ignore_rlimit_data, bool, 0644);
73
74static void unmap_region(struct mm_struct *mm,
75 struct vm_area_struct *vma, struct vm_area_struct *prev,
76 unsigned long start, unsigned long end);
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98pgprot_t protection_map[16] __ro_after_init = {
99 __P000, __P001, __P010, __P011, __P100, __P101, __P110, __P111,
100 __S000, __S001, __S010, __S011, __S100, __S101, __S110, __S111
101};
102
103#ifndef CONFIG_ARCH_HAS_FILTER_PGPROT
104static inline pgprot_t arch_filter_pgprot(pgprot_t prot)
105{
106 return prot;
107}
108#endif
109
110pgprot_t vm_get_page_prot(unsigned long vm_flags)
111{
112 pgprot_t ret = __pgprot(pgprot_val(protection_map[vm_flags &
113 (VM_READ|VM_WRITE|VM_EXEC|VM_SHARED)]) |
114 pgprot_val(arch_vm_get_page_prot(vm_flags)));
115
116 return arch_filter_pgprot(ret);
117}
118EXPORT_SYMBOL(vm_get_page_prot);
119
120static pgprot_t vm_pgprot_modify(pgprot_t oldprot, unsigned long vm_flags)
121{
122 return pgprot_modify(oldprot, vm_get_page_prot(vm_flags));
123}
124
125
126void vma_set_page_prot(struct vm_area_struct *vma)
127{
128 unsigned long vm_flags = vma->vm_flags;
129 pgprot_t vm_page_prot;
130
131 vm_page_prot = vm_pgprot_modify(vma->vm_page_prot, vm_flags);
132 if (vma_wants_writenotify(vma, vm_page_prot)) {
133 vm_flags &= ~VM_SHARED;
134 vm_page_prot = vm_pgprot_modify(vm_page_prot, vm_flags);
135 }
136
137 WRITE_ONCE(vma->vm_page_prot, vm_page_prot);
138}
139
140
141
142
143static void __remove_shared_vm_struct(struct vm_area_struct *vma,
144 struct file *file, struct address_space *mapping)
145{
146 if (vma->vm_flags & VM_DENYWRITE)
147 atomic_inc(&file_inode(file)->i_writecount);
148 if (vma->vm_flags & VM_SHARED)
149 mapping_unmap_writable(mapping);
150
151 flush_dcache_mmap_lock(mapping);
152 vma_interval_tree_remove(vma, &mapping->i_mmap);
153 flush_dcache_mmap_unlock(mapping);
154}
155
156
157
158
159
160void unlink_file_vma(struct vm_area_struct *vma)
161{
162 struct file *file = vma->vm_file;
163
164 if (file) {
165 struct address_space *mapping = file->f_mapping;
166 i_mmap_lock_write(mapping);
167 __remove_shared_vm_struct(vma, file, mapping);
168 i_mmap_unlock_write(mapping);
169 }
170}
171
172
173
174
175static struct vm_area_struct *remove_vma(struct vm_area_struct *vma)
176{
177 struct vm_area_struct *next = vma->vm_next;
178
179 might_sleep();
180 if (vma->vm_ops && vma->vm_ops->close)
181 vma->vm_ops->close(vma);
182 if (vma->vm_file)
183 fput(vma->vm_file);
184 mpol_put(vma_policy(vma));
185 kmem_cache_free(vm_area_cachep, vma);
186 return next;
187}
188
189static int do_brk(unsigned long addr, unsigned long len, struct list_head *uf);
190
191SYSCALL_DEFINE1(brk, unsigned long, brk)
192{
193 unsigned long retval;
194 unsigned long newbrk, oldbrk;
195 struct mm_struct *mm = current->mm;
196 struct vm_area_struct *next;
197 unsigned long min_brk;
198 bool populate;
199 LIST_HEAD(uf);
200
201 if (down_write_killable(&mm->mmap_sem))
202 return -EINTR;
203
204#ifdef CONFIG_COMPAT_BRK
205
206
207
208
209
210 if (current->brk_randomized)
211 min_brk = mm->start_brk;
212 else
213 min_brk = mm->end_data;
214#else
215 min_brk = mm->start_brk;
216#endif
217 if (brk < min_brk)
218 goto out;
219
220
221
222
223
224
225
226 if (check_data_rlimit(rlimit(RLIMIT_DATA), brk, mm->start_brk,
227 mm->end_data, mm->start_data))
228 goto out;
229
230 newbrk = PAGE_ALIGN(brk);
231 oldbrk = PAGE_ALIGN(mm->brk);
232 if (oldbrk == newbrk)
233 goto set_brk;
234
235
236 if (brk <= mm->brk) {
237 if (!do_munmap(mm, newbrk, oldbrk-newbrk, &uf))
238 goto set_brk;
239 goto out;
240 }
241
242
243 next = find_vma(mm, oldbrk);
244 if (next && newbrk + PAGE_SIZE > vm_start_gap(next))
245 goto out;
246
247
248 if (do_brk(oldbrk, newbrk-oldbrk, &uf) < 0)
249 goto out;
250
251set_brk:
252 mm->brk = brk;
253 populate = newbrk > oldbrk && (mm->def_flags & VM_LOCKED) != 0;
254 up_write(&mm->mmap_sem);
255 userfaultfd_unmap_complete(mm, &uf);
256 if (populate)
257 mm_populate(oldbrk, newbrk - oldbrk);
258 return brk;
259
260out:
261 retval = mm->brk;
262 up_write(&mm->mmap_sem);
263 return retval;
264}
265
266static long vma_compute_subtree_gap(struct vm_area_struct *vma)
267{
268 unsigned long max, prev_end, subtree_gap;
269
270
271
272
273
274
275
276 max = vm_start_gap(vma);
277 if (vma->vm_prev) {
278 prev_end = vm_end_gap(vma->vm_prev);
279 if (max > prev_end)
280 max -= prev_end;
281 else
282 max = 0;
283 }
284 if (vma->vm_rb.rb_left) {
285 subtree_gap = rb_entry(vma->vm_rb.rb_left,
286 struct vm_area_struct, vm_rb)->rb_subtree_gap;
287 if (subtree_gap > max)
288 max = subtree_gap;
289 }
290 if (vma->vm_rb.rb_right) {
291 subtree_gap = rb_entry(vma->vm_rb.rb_right,
292 struct vm_area_struct, vm_rb)->rb_subtree_gap;
293 if (subtree_gap > max)
294 max = subtree_gap;
295 }
296 return max;
297}
298
299#ifdef CONFIG_DEBUG_VM_RB
300static int browse_rb(struct mm_struct *mm)
301{
302 struct rb_root *root = &mm->mm_rb;
303 int i = 0, j, bug = 0;
304 struct rb_node *nd, *pn = NULL;
305 unsigned long prev = 0, pend = 0;
306
307 for (nd = rb_first(root); nd; nd = rb_next(nd)) {
308 struct vm_area_struct *vma;
309 vma = rb_entry(nd, struct vm_area_struct, vm_rb);
310 if (vma->vm_start < prev) {
311 pr_emerg("vm_start %lx < prev %lx\n",
312 vma->vm_start, prev);
313 bug = 1;
314 }
315 if (vma->vm_start < pend) {
316 pr_emerg("vm_start %lx < pend %lx\n",
317 vma->vm_start, pend);
318 bug = 1;
319 }
320 if (vma->vm_start > vma->vm_end) {
321 pr_emerg("vm_start %lx > vm_end %lx\n",
322 vma->vm_start, vma->vm_end);
323 bug = 1;
324 }
325 spin_lock(&mm->page_table_lock);
326 if (vma->rb_subtree_gap != vma_compute_subtree_gap(vma)) {
327 pr_emerg("free gap %lx, correct %lx\n",
328 vma->rb_subtree_gap,
329 vma_compute_subtree_gap(vma));
330 bug = 1;
331 }
332 spin_unlock(&mm->page_table_lock);
333 i++;
334 pn = nd;
335 prev = vma->vm_start;
336 pend = vma->vm_end;
337 }
338 j = 0;
339 for (nd = pn; nd; nd = rb_prev(nd))
340 j++;
341 if (i != j) {
342 pr_emerg("backwards %d, forwards %d\n", j, i);
343 bug = 1;
344 }
345 return bug ? -1 : i;
346}
347
348static void validate_mm_rb(struct rb_root *root, struct vm_area_struct *ignore)
349{
350 struct rb_node *nd;
351
352 for (nd = rb_first(root); nd; nd = rb_next(nd)) {
353 struct vm_area_struct *vma;
354 vma = rb_entry(nd, struct vm_area_struct, vm_rb);
355 VM_BUG_ON_VMA(vma != ignore &&
356 vma->rb_subtree_gap != vma_compute_subtree_gap(vma),
357 vma);
358 }
359}
360
361static void validate_mm(struct mm_struct *mm)
362{
363 int bug = 0;
364 int i = 0;
365 unsigned long highest_address = 0;
366 struct vm_area_struct *vma = mm->mmap;
367
368 while (vma) {
369 struct anon_vma *anon_vma = vma->anon_vma;
370 struct anon_vma_chain *avc;
371
372 if (anon_vma) {
373 anon_vma_lock_read(anon_vma);
374 list_for_each_entry(avc, &vma->anon_vma_chain, same_vma)
375 anon_vma_interval_tree_verify(avc);
376 anon_vma_unlock_read(anon_vma);
377 }
378
379 highest_address = vm_end_gap(vma);
380 vma = vma->vm_next;
381 i++;
382 }
383 if (i != mm->map_count) {
384 pr_emerg("map_count %d vm_next %d\n", mm->map_count, i);
385 bug = 1;
386 }
387 if (highest_address != mm->highest_vm_end) {
388 pr_emerg("mm->highest_vm_end %lx, found %lx\n",
389 mm->highest_vm_end, highest_address);
390 bug = 1;
391 }
392 i = browse_rb(mm);
393 if (i != mm->map_count) {
394 if (i != -1)
395 pr_emerg("map_count %d rb %d\n", mm->map_count, i);
396 bug = 1;
397 }
398 VM_BUG_ON_MM(bug, mm);
399}
400#else
401#define validate_mm_rb(root, ignore) do { } while (0)
402#define validate_mm(mm) do { } while (0)
403#endif
404
405RB_DECLARE_CALLBACKS(static, vma_gap_callbacks, struct vm_area_struct, vm_rb,
406 unsigned long, rb_subtree_gap, vma_compute_subtree_gap)
407
408
409
410
411
412
413static void vma_gap_update(struct vm_area_struct *vma)
414{
415
416
417
418
419 vma_gap_callbacks_propagate(&vma->vm_rb, NULL);
420}
421
422static inline void vma_rb_insert(struct vm_area_struct *vma,
423 struct rb_root *root)
424{
425
426 validate_mm_rb(root, NULL);
427
428 rb_insert_augmented(&vma->vm_rb, root, &vma_gap_callbacks);
429}
430
431static void __vma_rb_erase(struct vm_area_struct *vma, struct rb_root *root)
432{
433
434
435
436
437
438 rb_erase_augmented(&vma->vm_rb, root, &vma_gap_callbacks);
439}
440
441static __always_inline void vma_rb_erase_ignore(struct vm_area_struct *vma,
442 struct rb_root *root,
443 struct vm_area_struct *ignore)
444{
445
446
447
448
449
450 validate_mm_rb(root, ignore);
451
452 __vma_rb_erase(vma, root);
453}
454
455static __always_inline void vma_rb_erase(struct vm_area_struct *vma,
456 struct rb_root *root)
457{
458
459
460
461
462 validate_mm_rb(root, vma);
463
464 __vma_rb_erase(vma, root);
465}
466
467
468
469
470
471
472
473
474
475
476
477
478
479
480
481static inline void
482anon_vma_interval_tree_pre_update_vma(struct vm_area_struct *vma)
483{
484 struct anon_vma_chain *avc;
485
486 list_for_each_entry(avc, &vma->anon_vma_chain, same_vma)
487 anon_vma_interval_tree_remove(avc, &avc->anon_vma->rb_root);
488}
489
490static inline void
491anon_vma_interval_tree_post_update_vma(struct vm_area_struct *vma)
492{
493 struct anon_vma_chain *avc;
494
495 list_for_each_entry(avc, &vma->anon_vma_chain, same_vma)
496 anon_vma_interval_tree_insert(avc, &avc->anon_vma->rb_root);
497}
498
499static int find_vma_links(struct mm_struct *mm, unsigned long addr,
500 unsigned long end, struct vm_area_struct **pprev,
501 struct rb_node ***rb_link, struct rb_node **rb_parent)
502{
503 struct rb_node **__rb_link, *__rb_parent, *rb_prev;
504
505 __rb_link = &mm->mm_rb.rb_node;
506 rb_prev = __rb_parent = NULL;
507
508 while (*__rb_link) {
509 struct vm_area_struct *vma_tmp;
510
511 __rb_parent = *__rb_link;
512 vma_tmp = rb_entry(__rb_parent, struct vm_area_struct, vm_rb);
513
514 if (vma_tmp->vm_end > addr) {
515
516 if (vma_tmp->vm_start < end)
517 return -ENOMEM;
518 __rb_link = &__rb_parent->rb_left;
519 } else {
520 rb_prev = __rb_parent;
521 __rb_link = &__rb_parent->rb_right;
522 }
523 }
524
525 *pprev = NULL;
526 if (rb_prev)
527 *pprev = rb_entry(rb_prev, struct vm_area_struct, vm_rb);
528 *rb_link = __rb_link;
529 *rb_parent = __rb_parent;
530 return 0;
531}
532
533static unsigned long count_vma_pages_range(struct mm_struct *mm,
534 unsigned long addr, unsigned long end)
535{
536 unsigned long nr_pages = 0;
537 struct vm_area_struct *vma;
538
539
540 vma = find_vma_intersection(mm, addr, end);
541 if (!vma)
542 return 0;
543
544 nr_pages = (min(end, vma->vm_end) -
545 max(addr, vma->vm_start)) >> PAGE_SHIFT;
546
547
548 for (vma = vma->vm_next; vma; vma = vma->vm_next) {
549 unsigned long overlap_len;
550
551 if (vma->vm_start > end)
552 break;
553
554 overlap_len = min(end, vma->vm_end) - vma->vm_start;
555 nr_pages += overlap_len >> PAGE_SHIFT;
556 }
557
558 return nr_pages;
559}
560
561void __vma_link_rb(struct mm_struct *mm, struct vm_area_struct *vma,
562 struct rb_node **rb_link, struct rb_node *rb_parent)
563{
564
565 if (vma->vm_next)
566 vma_gap_update(vma->vm_next);
567 else
568 mm->highest_vm_end = vm_end_gap(vma);
569
570
571
572
573
574
575
576
577
578
579 rb_link_node(&vma->vm_rb, rb_parent, rb_link);
580 vma->rb_subtree_gap = 0;
581 vma_gap_update(vma);
582 vma_rb_insert(vma, &mm->mm_rb);
583}
584
585static void __vma_link_file(struct vm_area_struct *vma)
586{
587 struct file *file;
588
589 file = vma->vm_file;
590 if (file) {
591 struct address_space *mapping = file->f_mapping;
592
593 if (vma->vm_flags & VM_DENYWRITE)
594 atomic_dec(&file_inode(file)->i_writecount);
595 if (vma->vm_flags & VM_SHARED)
596 atomic_inc(&mapping->i_mmap_writable);
597
598 flush_dcache_mmap_lock(mapping);
599 vma_interval_tree_insert(vma, &mapping->i_mmap);
600 flush_dcache_mmap_unlock(mapping);
601 }
602}
603
604static void
605__vma_link(struct mm_struct *mm, struct vm_area_struct *vma,
606 struct vm_area_struct *prev, struct rb_node **rb_link,
607 struct rb_node *rb_parent)
608{
609 __vma_link_list(mm, vma, prev, rb_parent);
610 __vma_link_rb(mm, vma, rb_link, rb_parent);
611}
612
613static void vma_link(struct mm_struct *mm, struct vm_area_struct *vma,
614 struct vm_area_struct *prev, struct rb_node **rb_link,
615 struct rb_node *rb_parent)
616{
617 struct address_space *mapping = NULL;
618
619 if (vma->vm_file) {
620 mapping = vma->vm_file->f_mapping;
621 i_mmap_lock_write(mapping);
622 }
623
624 __vma_link(mm, vma, prev, rb_link, rb_parent);
625 __vma_link_file(vma);
626
627 if (mapping)
628 i_mmap_unlock_write(mapping);
629
630 mm->map_count++;
631 validate_mm(mm);
632}
633
634
635
636
637
638static void __insert_vm_struct(struct mm_struct *mm, struct vm_area_struct *vma)
639{
640 struct vm_area_struct *prev;
641 struct rb_node **rb_link, *rb_parent;
642
643 if (find_vma_links(mm, vma->vm_start, vma->vm_end,
644 &prev, &rb_link, &rb_parent))
645 BUG();
646 __vma_link(mm, vma, prev, rb_link, rb_parent);
647 mm->map_count++;
648}
649
650static __always_inline void __vma_unlink_common(struct mm_struct *mm,
651 struct vm_area_struct *vma,
652 struct vm_area_struct *prev,
653 bool has_prev,
654 struct vm_area_struct *ignore)
655{
656 struct vm_area_struct *next;
657
658 vma_rb_erase_ignore(vma, &mm->mm_rb, ignore);
659 next = vma->vm_next;
660 if (has_prev)
661 prev->vm_next = next;
662 else {
663 prev = vma->vm_prev;
664 if (prev)
665 prev->vm_next = next;
666 else
667 mm->mmap = next;
668 }
669 if (next)
670 next->vm_prev = prev;
671
672
673 vmacache_invalidate(mm);
674}
675
676static inline void __vma_unlink_prev(struct mm_struct *mm,
677 struct vm_area_struct *vma,
678 struct vm_area_struct *prev)
679{
680 __vma_unlink_common(mm, vma, prev, true, vma);
681}
682
683
684
685
686
687
688
689
690int __vma_adjust(struct vm_area_struct *vma, unsigned long start,
691 unsigned long end, pgoff_t pgoff, struct vm_area_struct *insert,
692 struct vm_area_struct *expand)
693{
694 struct mm_struct *mm = vma->vm_mm;
695 struct vm_area_struct *next = vma->vm_next, *orig_vma = vma;
696 struct address_space *mapping = NULL;
697 struct rb_root_cached *root = NULL;
698 struct anon_vma *anon_vma = NULL;
699 struct file *file = vma->vm_file;
700 bool start_changed = false, end_changed = false;
701 long adjust_next = 0;
702 int remove_next = 0;
703
704 if (next && !insert) {
705 struct vm_area_struct *exporter = NULL, *importer = NULL;
706
707 if (end >= next->vm_end) {
708
709
710
711
712
713
714 if (next == expand) {
715
716
717
718
719 VM_WARN_ON(end != next->vm_end);
720
721
722
723
724
725 remove_next = 3;
726 VM_WARN_ON(file != next->vm_file);
727 swap(vma, next);
728 } else {
729 VM_WARN_ON(expand != vma);
730
731
732
733
734 remove_next = 1 + (end > next->vm_end);
735 VM_WARN_ON(remove_next == 2 &&
736 end != next->vm_next->vm_end);
737 VM_WARN_ON(remove_next == 1 &&
738 end != next->vm_end);
739
740 end = next->vm_end;
741 }
742
743 exporter = next;
744 importer = vma;
745
746
747
748
749
750 if (remove_next == 2 && !next->anon_vma)
751 exporter = next->vm_next;
752
753 } else if (end > next->vm_start) {
754
755
756
757
758 adjust_next = (end - next->vm_start) >> PAGE_SHIFT;
759 exporter = next;
760 importer = vma;
761 VM_WARN_ON(expand != importer);
762 } else if (end < vma->vm_end) {
763
764
765
766
767
768 adjust_next = -((vma->vm_end - end) >> PAGE_SHIFT);
769 exporter = vma;
770 importer = next;
771 VM_WARN_ON(expand != importer);
772 }
773
774
775
776
777
778
779 if (exporter && exporter->anon_vma && !importer->anon_vma) {
780 int error;
781
782 importer->anon_vma = exporter->anon_vma;
783 error = anon_vma_clone(importer, exporter);
784 if (error)
785 return error;
786 }
787 }
788again:
789 vma_adjust_trans_huge(orig_vma, start, end, adjust_next);
790
791 if (file) {
792 mapping = file->f_mapping;
793 root = &mapping->i_mmap;
794 uprobe_munmap(vma, vma->vm_start, vma->vm_end);
795
796 if (adjust_next)
797 uprobe_munmap(next, next->vm_start, next->vm_end);
798
799 i_mmap_lock_write(mapping);
800 if (insert) {
801
802
803
804
805
806
807 __vma_link_file(insert);
808 }
809 }
810
811 anon_vma = vma->anon_vma;
812 if (!anon_vma && adjust_next)
813 anon_vma = next->anon_vma;
814 if (anon_vma) {
815 VM_WARN_ON(adjust_next && next->anon_vma &&
816 anon_vma != next->anon_vma);
817 anon_vma_lock_write(anon_vma);
818 anon_vma_interval_tree_pre_update_vma(vma);
819 if (adjust_next)
820 anon_vma_interval_tree_pre_update_vma(next);
821 }
822
823 if (root) {
824 flush_dcache_mmap_lock(mapping);
825 vma_interval_tree_remove(vma, root);
826 if (adjust_next)
827 vma_interval_tree_remove(next, root);
828 }
829
830 if (start != vma->vm_start) {
831 vma->vm_start = start;
832 start_changed = true;
833 }
834 if (end != vma->vm_end) {
835 vma->vm_end = end;
836 end_changed = true;
837 }
838 vma->vm_pgoff = pgoff;
839 if (adjust_next) {
840 next->vm_start += adjust_next << PAGE_SHIFT;
841 next->vm_pgoff += adjust_next;
842 }
843
844 if (root) {
845 if (adjust_next)
846 vma_interval_tree_insert(next, root);
847 vma_interval_tree_insert(vma, root);
848 flush_dcache_mmap_unlock(mapping);
849 }
850
851 if (remove_next) {
852
853
854
855
856 if (remove_next != 3)
857 __vma_unlink_prev(mm, next, vma);
858 else
859
860
861
862
863
864
865
866
867
868 __vma_unlink_common(mm, next, NULL, false, vma);
869 if (file)
870 __remove_shared_vm_struct(next, file, mapping);
871 } else if (insert) {
872
873
874
875
876
877 __insert_vm_struct(mm, insert);
878 } else {
879 if (start_changed)
880 vma_gap_update(vma);
881 if (end_changed) {
882 if (!next)
883 mm->highest_vm_end = vm_end_gap(vma);
884 else if (!adjust_next)
885 vma_gap_update(next);
886 }
887 }
888
889 if (anon_vma) {
890 anon_vma_interval_tree_post_update_vma(vma);
891 if (adjust_next)
892 anon_vma_interval_tree_post_update_vma(next);
893 anon_vma_unlock_write(anon_vma);
894 }
895 if (mapping)
896 i_mmap_unlock_write(mapping);
897
898 if (root) {
899 uprobe_mmap(vma);
900
901 if (adjust_next)
902 uprobe_mmap(next);
903 }
904
905 if (remove_next) {
906 if (file) {
907 uprobe_munmap(next, next->vm_start, next->vm_end);
908 fput(file);
909 }
910 if (next->anon_vma)
911 anon_vma_merge(vma, next);
912 mm->map_count--;
913 mpol_put(vma_policy(next));
914 kmem_cache_free(vm_area_cachep, next);
915
916
917
918
919
920 if (remove_next != 3) {
921
922
923
924
925
926
927 next = vma->vm_next;
928 } else {
929
930
931
932
933
934
935
936
937
938
939 next = vma;
940 }
941 if (remove_next == 2) {
942 remove_next = 1;
943 end = next->vm_end;
944 goto again;
945 }
946 else if (next)
947 vma_gap_update(next);
948 else {
949
950
951
952
953
954
955
956
957
958
959
960
961
962
963
964
965
966
967
968 VM_WARN_ON(mm->highest_vm_end != vm_end_gap(vma));
969 }
970 }
971 if (insert && file)
972 uprobe_mmap(insert);
973
974 validate_mm(mm);
975
976 return 0;
977}
978
979
980
981
982
983static inline int is_mergeable_vma(struct vm_area_struct *vma,
984 struct file *file, unsigned long vm_flags,
985 struct vm_userfaultfd_ctx vm_userfaultfd_ctx)
986{
987
988
989
990
991
992
993
994
995 if ((vma->vm_flags ^ vm_flags) & ~VM_SOFTDIRTY)
996 return 0;
997 if (vma->vm_file != file)
998 return 0;
999 if (vma->vm_ops && vma->vm_ops->close)
1000 return 0;
1001 if (!is_mergeable_vm_userfaultfd_ctx(vma, vm_userfaultfd_ctx))
1002 return 0;
1003 return 1;
1004}
1005
1006static inline int is_mergeable_anon_vma(struct anon_vma *anon_vma1,
1007 struct anon_vma *anon_vma2,
1008 struct vm_area_struct *vma)
1009{
1010
1011
1012
1013
1014 if ((!anon_vma1 || !anon_vma2) && (!vma ||
1015 list_is_singular(&vma->anon_vma_chain)))
1016 return 1;
1017 return anon_vma1 == anon_vma2;
1018}
1019
1020
1021
1022
1023
1024
1025
1026
1027
1028
1029
1030
1031static int
1032can_vma_merge_before(struct vm_area_struct *vma, unsigned long vm_flags,
1033 struct anon_vma *anon_vma, struct file *file,
1034 pgoff_t vm_pgoff,
1035 struct vm_userfaultfd_ctx vm_userfaultfd_ctx)
1036{
1037 if (is_mergeable_vma(vma, file, vm_flags, vm_userfaultfd_ctx) &&
1038 is_mergeable_anon_vma(anon_vma, vma->anon_vma, vma)) {
1039 if (vma->vm_pgoff == vm_pgoff)
1040 return 1;
1041 }
1042 return 0;
1043}
1044
1045
1046
1047
1048
1049
1050
1051
1052static int
1053can_vma_merge_after(struct vm_area_struct *vma, unsigned long vm_flags,
1054 struct anon_vma *anon_vma, struct file *file,
1055 pgoff_t vm_pgoff,
1056 struct vm_userfaultfd_ctx vm_userfaultfd_ctx)
1057{
1058 if (is_mergeable_vma(vma, file, vm_flags, vm_userfaultfd_ctx) &&
1059 is_mergeable_anon_vma(anon_vma, vma->anon_vma, vma)) {
1060 pgoff_t vm_pglen;
1061 vm_pglen = vma_pages(vma);
1062 if (vma->vm_pgoff + vm_pglen == vm_pgoff)
1063 return 1;
1064 }
1065 return 0;
1066}
1067
1068
1069
1070
1071
1072
1073
1074
1075
1076
1077
1078
1079
1080
1081
1082
1083
1084
1085
1086
1087
1088
1089
1090
1091
1092
1093
1094
1095
1096
1097
1098
1099
1100
1101
1102
1103
1104
1105
1106
1107
1108struct vm_area_struct *vma_merge(struct mm_struct *mm,
1109 struct vm_area_struct *prev, unsigned long addr,
1110 unsigned long end, unsigned long vm_flags,
1111 struct anon_vma *anon_vma, struct file *file,
1112 pgoff_t pgoff, struct mempolicy *policy,
1113 struct vm_userfaultfd_ctx vm_userfaultfd_ctx)
1114{
1115 pgoff_t pglen = (end - addr) >> PAGE_SHIFT;
1116 struct vm_area_struct *area, *next;
1117 int err;
1118
1119
1120
1121
1122
1123 if (vm_flags & VM_SPECIAL)
1124 return NULL;
1125
1126 if (prev)
1127 next = prev->vm_next;
1128 else
1129 next = mm->mmap;
1130 area = next;
1131 if (area && area->vm_end == end)
1132 next = next->vm_next;
1133
1134
1135 VM_WARN_ON(prev && addr <= prev->vm_start);
1136 VM_WARN_ON(area && end > area->vm_end);
1137 VM_WARN_ON(addr >= end);
1138
1139
1140
1141
1142 if (prev && prev->vm_end == addr &&
1143 mpol_equal(vma_policy(prev), policy) &&
1144 can_vma_merge_after(prev, vm_flags,
1145 anon_vma, file, pgoff,
1146 vm_userfaultfd_ctx)) {
1147
1148
1149
1150 if (next && end == next->vm_start &&
1151 mpol_equal(policy, vma_policy(next)) &&
1152 can_vma_merge_before(next, vm_flags,
1153 anon_vma, file,
1154 pgoff+pglen,
1155 vm_userfaultfd_ctx) &&
1156 is_mergeable_anon_vma(prev->anon_vma,
1157 next->anon_vma, NULL)) {
1158
1159 err = __vma_adjust(prev, prev->vm_start,
1160 next->vm_end, prev->vm_pgoff, NULL,
1161 prev);
1162 } else
1163 err = __vma_adjust(prev, prev->vm_start,
1164 end, prev->vm_pgoff, NULL, prev);
1165 if (err)
1166 return NULL;
1167 khugepaged_enter_vma_merge(prev, vm_flags);
1168 return prev;
1169 }
1170
1171
1172
1173
1174 if (next && end == next->vm_start &&
1175 mpol_equal(policy, vma_policy(next)) &&
1176 can_vma_merge_before(next, vm_flags,
1177 anon_vma, file, pgoff+pglen,
1178 vm_userfaultfd_ctx)) {
1179 if (prev && addr < prev->vm_end)
1180 err = __vma_adjust(prev, prev->vm_start,
1181 addr, prev->vm_pgoff, NULL, next);
1182 else {
1183 err = __vma_adjust(area, addr, next->vm_end,
1184 next->vm_pgoff - pglen, NULL, next);
1185
1186
1187
1188
1189
1190 area = next;
1191 }
1192 if (err)
1193 return NULL;
1194 khugepaged_enter_vma_merge(area, vm_flags);
1195 return area;
1196 }
1197
1198 return NULL;
1199}
1200
1201
1202
1203
1204
1205
1206
1207
1208
1209
1210
1211
1212
1213
1214static int anon_vma_compatible(struct vm_area_struct *a, struct vm_area_struct *b)
1215{
1216 return a->vm_end == b->vm_start &&
1217 mpol_equal(vma_policy(a), vma_policy(b)) &&
1218 a->vm_file == b->vm_file &&
1219 !((a->vm_flags ^ b->vm_flags) & ~(VM_READ|VM_WRITE|VM_EXEC|VM_SOFTDIRTY)) &&
1220 b->vm_pgoff == a->vm_pgoff + ((b->vm_start - a->vm_start) >> PAGE_SHIFT);
1221}
1222
1223
1224
1225
1226
1227
1228
1229
1230
1231
1232
1233
1234
1235
1236
1237
1238
1239
1240
1241
1242
1243
1244
1245static struct anon_vma *reusable_anon_vma(struct vm_area_struct *old, struct vm_area_struct *a, struct vm_area_struct *b)
1246{
1247 if (anon_vma_compatible(a, b)) {
1248 struct anon_vma *anon_vma = READ_ONCE(old->anon_vma);
1249
1250 if (anon_vma && list_is_singular(&old->anon_vma_chain))
1251 return anon_vma;
1252 }
1253 return NULL;
1254}
1255
1256
1257
1258
1259
1260
1261
1262
1263
1264struct anon_vma *find_mergeable_anon_vma(struct vm_area_struct *vma)
1265{
1266 struct anon_vma *anon_vma;
1267 struct vm_area_struct *near;
1268
1269 near = vma->vm_next;
1270 if (!near)
1271 goto try_prev;
1272
1273 anon_vma = reusable_anon_vma(near, vma, near);
1274 if (anon_vma)
1275 return anon_vma;
1276try_prev:
1277 near = vma->vm_prev;
1278 if (!near)
1279 goto none;
1280
1281 anon_vma = reusable_anon_vma(near, near, vma);
1282 if (anon_vma)
1283 return anon_vma;
1284none:
1285
1286
1287
1288
1289
1290
1291
1292
1293 return NULL;
1294}
1295
1296
1297
1298
1299
1300static inline unsigned long round_hint_to_min(unsigned long hint)
1301{
1302 hint &= PAGE_MASK;
1303 if (((void *)hint != NULL) &&
1304 (hint < mmap_min_addr))
1305 return PAGE_ALIGN(mmap_min_addr);
1306 return hint;
1307}
1308
1309static inline int mlock_future_check(struct mm_struct *mm,
1310 unsigned long flags,
1311 unsigned long len)
1312{
1313 unsigned long locked, lock_limit;
1314
1315
1316 if (flags & VM_LOCKED) {
1317 locked = len >> PAGE_SHIFT;
1318 locked += mm->locked_vm;
1319 lock_limit = rlimit(RLIMIT_MEMLOCK);
1320 lock_limit >>= PAGE_SHIFT;
1321 if (locked > lock_limit && !capable(CAP_IPC_LOCK))
1322 return -EAGAIN;
1323 }
1324 return 0;
1325}
1326
1327static inline u64 file_mmap_size_max(struct file *file, struct inode *inode)
1328{
1329 if (S_ISREG(inode->i_mode))
1330 return MAX_LFS_FILESIZE;
1331
1332 if (S_ISBLK(inode->i_mode))
1333 return MAX_LFS_FILESIZE;
1334
1335
1336 if (file->f_mode & FMODE_UNSIGNED_OFFSET)
1337 return 0;
1338
1339
1340 return ULONG_MAX;
1341}
1342
1343static inline bool file_mmap_ok(struct file *file, struct inode *inode,
1344 unsigned long pgoff, unsigned long len)
1345{
1346 u64 maxsize = file_mmap_size_max(file, inode);
1347
1348 if (maxsize && len > maxsize)
1349 return false;
1350 maxsize -= len;
1351 if (pgoff > maxsize >> PAGE_SHIFT)
1352 return false;
1353 return true;
1354}
1355
1356
1357
1358
1359unsigned long do_mmap(struct file *file, unsigned long addr,
1360 unsigned long len, unsigned long prot,
1361 unsigned long flags, vm_flags_t vm_flags,
1362 unsigned long pgoff, unsigned long *populate,
1363 struct list_head *uf)
1364{
1365 struct mm_struct *mm = current->mm;
1366 int pkey = 0;
1367
1368 *populate = 0;
1369
1370 if (!len)
1371 return -EINVAL;
1372
1373
1374
1375
1376
1377
1378
1379 if ((prot & PROT_READ) && (current->personality & READ_IMPLIES_EXEC))
1380 if (!(file && path_noexec(&file->f_path)))
1381 prot |= PROT_EXEC;
1382
1383
1384 if (flags & MAP_FIXED_NOREPLACE)
1385 flags |= MAP_FIXED;
1386
1387 if (!(flags & MAP_FIXED))
1388 addr = round_hint_to_min(addr);
1389
1390
1391 len = PAGE_ALIGN(len);
1392 if (!len)
1393 return -ENOMEM;
1394
1395
1396 if ((pgoff + (len >> PAGE_SHIFT)) < pgoff)
1397 return -EOVERFLOW;
1398
1399
1400 if (mm->map_count > sysctl_max_map_count)
1401 return -ENOMEM;
1402
1403
1404
1405
1406 addr = get_unmapped_area(file, addr, len, pgoff, flags);
1407 if (offset_in_page(addr))
1408 return addr;
1409
1410 if (flags & MAP_FIXED_NOREPLACE) {
1411 struct vm_area_struct *vma = find_vma(mm, addr);
1412
1413 if (vma && vma->vm_start <= addr)
1414 return -EEXIST;
1415 }
1416
1417 if (prot == PROT_EXEC) {
1418 pkey = execute_only_pkey(mm);
1419 if (pkey < 0)
1420 pkey = 0;
1421 }
1422
1423
1424
1425
1426
1427 vm_flags |= calc_vm_prot_bits(prot, pkey) | calc_vm_flag_bits(flags) |
1428 mm->def_flags | VM_MAYREAD | VM_MAYWRITE | VM_MAYEXEC;
1429
1430 if (flags & MAP_LOCKED)
1431 if (!can_do_mlock())
1432 return -EPERM;
1433
1434 if (mlock_future_check(mm, vm_flags, len))
1435 return -EAGAIN;
1436
1437 if (file) {
1438 struct inode *inode = file_inode(file);
1439 unsigned long flags_mask;
1440
1441 if (!file_mmap_ok(file, inode, pgoff, len))
1442 return -EOVERFLOW;
1443
1444 flags_mask = LEGACY_MAP_MASK | file->f_op->mmap_supported_flags;
1445
1446 switch (flags & MAP_TYPE) {
1447 case MAP_SHARED:
1448
1449
1450
1451
1452
1453
1454
1455 flags &= LEGACY_MAP_MASK;
1456
1457 case MAP_SHARED_VALIDATE:
1458 if (flags & ~flags_mask)
1459 return -EOPNOTSUPP;
1460 if ((prot&PROT_WRITE) && !(file->f_mode&FMODE_WRITE))
1461 return -EACCES;
1462
1463
1464
1465
1466
1467 if (IS_APPEND(inode) && (file->f_mode & FMODE_WRITE))
1468 return -EACCES;
1469
1470
1471
1472
1473 if (locks_verify_locked(file))
1474 return -EAGAIN;
1475
1476 vm_flags |= VM_SHARED | VM_MAYSHARE;
1477 if (!(file->f_mode & FMODE_WRITE))
1478 vm_flags &= ~(VM_MAYWRITE | VM_SHARED);
1479
1480
1481 case MAP_PRIVATE:
1482 if (!(file->f_mode & FMODE_READ))
1483 return -EACCES;
1484 if (path_noexec(&file->f_path)) {
1485 if (vm_flags & VM_EXEC)
1486 return -EPERM;
1487 vm_flags &= ~VM_MAYEXEC;
1488 }
1489
1490 if (!file->f_op->mmap)
1491 return -ENODEV;
1492 if (vm_flags & (VM_GROWSDOWN|VM_GROWSUP))
1493 return -EINVAL;
1494 break;
1495
1496 default:
1497 return -EINVAL;
1498 }
1499 } else {
1500 switch (flags & MAP_TYPE) {
1501 case MAP_SHARED:
1502 if (vm_flags & (VM_GROWSDOWN|VM_GROWSUP))
1503 return -EINVAL;
1504
1505
1506
1507 pgoff = 0;
1508 vm_flags |= VM_SHARED | VM_MAYSHARE;
1509 break;
1510 case MAP_PRIVATE:
1511
1512
1513
1514 pgoff = addr >> PAGE_SHIFT;
1515 break;
1516 default:
1517 return -EINVAL;
1518 }
1519 }
1520
1521
1522
1523
1524
1525 if (flags & MAP_NORESERVE) {
1526
1527 if (sysctl_overcommit_memory != OVERCOMMIT_NEVER)
1528 vm_flags |= VM_NORESERVE;
1529
1530
1531 if (file && is_file_hugepages(file))
1532 vm_flags |= VM_NORESERVE;
1533 }
1534
1535 addr = mmap_region(file, addr, len, vm_flags, pgoff, uf);
1536 if (!IS_ERR_VALUE(addr) &&
1537 ((vm_flags & VM_LOCKED) ||
1538 (flags & (MAP_POPULATE | MAP_NONBLOCK)) == MAP_POPULATE))
1539 *populate = len;
1540 return addr;
1541}
1542
1543unsigned long ksys_mmap_pgoff(unsigned long addr, unsigned long len,
1544 unsigned long prot, unsigned long flags,
1545 unsigned long fd, unsigned long pgoff)
1546{
1547 struct file *file = NULL;
1548 unsigned long retval;
1549
1550 if (!(flags & MAP_ANONYMOUS)) {
1551 audit_mmap_fd(fd, flags);
1552 file = fget(fd);
1553 if (!file)
1554 return -EBADF;
1555 if (is_file_hugepages(file))
1556 len = ALIGN(len, huge_page_size(hstate_file(file)));
1557 retval = -EINVAL;
1558 if (unlikely(flags & MAP_HUGETLB && !is_file_hugepages(file)))
1559 goto out_fput;
1560 } else if (flags & MAP_HUGETLB) {
1561 struct user_struct *user = NULL;
1562 struct hstate *hs;
1563
1564 hs = hstate_sizelog((flags >> MAP_HUGE_SHIFT) & MAP_HUGE_MASK);
1565 if (!hs)
1566 return -EINVAL;
1567
1568 len = ALIGN(len, huge_page_size(hs));
1569
1570
1571
1572
1573
1574
1575 file = hugetlb_file_setup(HUGETLB_ANON_FILE, len,
1576 VM_NORESERVE,
1577 &user, HUGETLB_ANONHUGE_INODE,
1578 (flags >> MAP_HUGE_SHIFT) & MAP_HUGE_MASK);
1579 if (IS_ERR(file))
1580 return PTR_ERR(file);
1581 }
1582
1583 flags &= ~(MAP_EXECUTABLE | MAP_DENYWRITE);
1584
1585 retval = vm_mmap_pgoff(file, addr, len, prot, flags, pgoff);
1586out_fput:
1587 if (file)
1588 fput(file);
1589 return retval;
1590}
1591
1592SYSCALL_DEFINE6(mmap_pgoff, unsigned long, addr, unsigned long, len,
1593 unsigned long, prot, unsigned long, flags,
1594 unsigned long, fd, unsigned long, pgoff)
1595{
1596 return ksys_mmap_pgoff(addr, len, prot, flags, fd, pgoff);
1597}
1598
1599#ifdef __ARCH_WANT_SYS_OLD_MMAP
1600struct mmap_arg_struct {
1601 unsigned long addr;
1602 unsigned long len;
1603 unsigned long prot;
1604 unsigned long flags;
1605 unsigned long fd;
1606 unsigned long offset;
1607};
1608
1609SYSCALL_DEFINE1(old_mmap, struct mmap_arg_struct __user *, arg)
1610{
1611 struct mmap_arg_struct a;
1612
1613 if (copy_from_user(&a, arg, sizeof(a)))
1614 return -EFAULT;
1615 if (offset_in_page(a.offset))
1616 return -EINVAL;
1617
1618 return ksys_mmap_pgoff(a.addr, a.len, a.prot, a.flags, a.fd,
1619 a.offset >> PAGE_SHIFT);
1620}
1621#endif
1622
1623
1624
1625
1626
1627
1628
1629int vma_wants_writenotify(struct vm_area_struct *vma, pgprot_t vm_page_prot)
1630{
1631 vm_flags_t vm_flags = vma->vm_flags;
1632 const struct vm_operations_struct *vm_ops = vma->vm_ops;
1633
1634
1635 if ((vm_flags & (VM_WRITE|VM_SHARED)) != ((VM_WRITE|VM_SHARED)))
1636 return 0;
1637
1638
1639 if (vm_ops && (vm_ops->page_mkwrite || vm_ops->pfn_mkwrite))
1640 return 1;
1641
1642
1643
1644 if (pgprot_val(vm_page_prot) !=
1645 pgprot_val(vm_pgprot_modify(vm_page_prot, vm_flags)))
1646 return 0;
1647
1648
1649 if (IS_ENABLED(CONFIG_MEM_SOFT_DIRTY) && !(vm_flags & VM_SOFTDIRTY))
1650 return 1;
1651
1652
1653 if (vm_flags & VM_PFNMAP)
1654 return 0;
1655
1656
1657 return vma->vm_file && vma->vm_file->f_mapping &&
1658 mapping_cap_account_dirty(vma->vm_file->f_mapping);
1659}
1660
1661
1662
1663
1664
1665static inline int accountable_mapping(struct file *file, vm_flags_t vm_flags)
1666{
1667
1668
1669
1670
1671 if (file && is_file_hugepages(file))
1672 return 0;
1673
1674 return (vm_flags & (VM_NORESERVE | VM_SHARED | VM_WRITE)) == VM_WRITE;
1675}
1676
1677unsigned long mmap_region(struct file *file, unsigned long addr,
1678 unsigned long len, vm_flags_t vm_flags, unsigned long pgoff,
1679 struct list_head *uf)
1680{
1681 struct mm_struct *mm = current->mm;
1682 struct vm_area_struct *vma, *prev;
1683 int error;
1684 struct rb_node **rb_link, *rb_parent;
1685 unsigned long charged = 0;
1686
1687
1688 if (!may_expand_vm(mm, vm_flags, len >> PAGE_SHIFT)) {
1689 unsigned long nr_pages;
1690
1691
1692
1693
1694
1695 nr_pages = count_vma_pages_range(mm, addr, addr + len);
1696
1697 if (!may_expand_vm(mm, vm_flags,
1698 (len >> PAGE_SHIFT) - nr_pages))
1699 return -ENOMEM;
1700 }
1701
1702
1703 while (find_vma_links(mm, addr, addr + len, &prev, &rb_link,
1704 &rb_parent)) {
1705 if (do_munmap(mm, addr, len, uf))
1706 return -ENOMEM;
1707 }
1708
1709
1710
1711
1712 if (accountable_mapping(file, vm_flags)) {
1713 charged = len >> PAGE_SHIFT;
1714 if (security_vm_enough_memory_mm(mm, charged))
1715 return -ENOMEM;
1716 vm_flags |= VM_ACCOUNT;
1717 }
1718
1719
1720
1721
1722 vma = vma_merge(mm, prev, addr, addr + len, vm_flags,
1723 NULL, file, pgoff, NULL, NULL_VM_UFFD_CTX);
1724 if (vma)
1725 goto out;
1726
1727
1728
1729
1730
1731
1732 vma = kmem_cache_zalloc(vm_area_cachep, GFP_KERNEL);
1733 if (!vma) {
1734 error = -ENOMEM;
1735 goto unacct_error;
1736 }
1737
1738 vma->vm_mm = mm;
1739 vma->vm_start = addr;
1740 vma->vm_end = addr + len;
1741 vma->vm_flags = vm_flags;
1742 vma->vm_page_prot = vm_get_page_prot(vm_flags);
1743 vma->vm_pgoff = pgoff;
1744 INIT_LIST_HEAD(&vma->anon_vma_chain);
1745
1746 if (file) {
1747 if (vm_flags & VM_DENYWRITE) {
1748 error = deny_write_access(file);
1749 if (error)
1750 goto free_vma;
1751 }
1752 if (vm_flags & VM_SHARED) {
1753 error = mapping_map_writable(file->f_mapping);
1754 if (error)
1755 goto allow_write_and_free_vma;
1756 }
1757
1758
1759
1760
1761
1762
1763 vma->vm_file = get_file(file);
1764 error = call_mmap(file, vma);
1765 if (error)
1766 goto unmap_and_free_vma;
1767
1768
1769
1770
1771
1772
1773
1774
1775 WARN_ON_ONCE(addr != vma->vm_start);
1776
1777 addr = vma->vm_start;
1778 vm_flags = vma->vm_flags;
1779 } else if (vm_flags & VM_SHARED) {
1780 error = shmem_zero_setup(vma);
1781 if (error)
1782 goto free_vma;
1783 }
1784
1785 vma_link(mm, vma, prev, rb_link, rb_parent);
1786
1787 if (file) {
1788 if (vm_flags & VM_SHARED)
1789 mapping_unmap_writable(file->f_mapping);
1790 if (vm_flags & VM_DENYWRITE)
1791 allow_write_access(file);
1792 }
1793 file = vma->vm_file;
1794out:
1795 perf_event_mmap(vma);
1796
1797 vm_stat_account(mm, vm_flags, len >> PAGE_SHIFT);
1798 if (vm_flags & VM_LOCKED) {
1799 if (!((vm_flags & VM_SPECIAL) || is_vm_hugetlb_page(vma) ||
1800 vma == get_gate_vma(current->mm)))
1801 mm->locked_vm += (len >> PAGE_SHIFT);
1802 else
1803 vma->vm_flags &= VM_LOCKED_CLEAR_MASK;
1804 }
1805
1806 if (file)
1807 uprobe_mmap(vma);
1808
1809
1810
1811
1812
1813
1814
1815
1816 vma->vm_flags |= VM_SOFTDIRTY;
1817
1818 vma_set_page_prot(vma);
1819
1820 return addr;
1821
1822unmap_and_free_vma:
1823 vma->vm_file = NULL;
1824 fput(file);
1825
1826
1827 unmap_region(mm, vma, prev, vma->vm_start, vma->vm_end);
1828 charged = 0;
1829 if (vm_flags & VM_SHARED)
1830 mapping_unmap_writable(file->f_mapping);
1831allow_write_and_free_vma:
1832 if (vm_flags & VM_DENYWRITE)
1833 allow_write_access(file);
1834free_vma:
1835 kmem_cache_free(vm_area_cachep, vma);
1836unacct_error:
1837 if (charged)
1838 vm_unacct_memory(charged);
1839 return error;
1840}
1841
1842unsigned long unmapped_area(struct vm_unmapped_area_info *info)
1843{
1844
1845
1846
1847
1848
1849
1850
1851
1852 struct mm_struct *mm = current->mm;
1853 struct vm_area_struct *vma;
1854 unsigned long length, low_limit, high_limit, gap_start, gap_end;
1855
1856
1857 length = info->length + info->align_mask;
1858 if (length < info->length)
1859 return -ENOMEM;
1860
1861
1862 if (info->high_limit < length)
1863 return -ENOMEM;
1864 high_limit = info->high_limit - length;
1865
1866 if (info->low_limit > high_limit)
1867 return -ENOMEM;
1868 low_limit = info->low_limit + length;
1869
1870
1871 if (RB_EMPTY_ROOT(&mm->mm_rb))
1872 goto check_highest;
1873 vma = rb_entry(mm->mm_rb.rb_node, struct vm_area_struct, vm_rb);
1874 if (vma->rb_subtree_gap < length)
1875 goto check_highest;
1876
1877 while (true) {
1878
1879 gap_end = vm_start_gap(vma);
1880 if (gap_end >= low_limit && vma->vm_rb.rb_left) {
1881 struct vm_area_struct *left =
1882 rb_entry(vma->vm_rb.rb_left,
1883 struct vm_area_struct, vm_rb);
1884 if (left->rb_subtree_gap >= length) {
1885 vma = left;
1886 continue;
1887 }
1888 }
1889
1890 gap_start = vma->vm_prev ? vm_end_gap(vma->vm_prev) : 0;
1891check_current:
1892
1893 if (gap_start > high_limit)
1894 return -ENOMEM;
1895 if (gap_end >= low_limit &&
1896 gap_end > gap_start && gap_end - gap_start >= length)
1897 goto found;
1898
1899
1900 if (vma->vm_rb.rb_right) {
1901 struct vm_area_struct *right =
1902 rb_entry(vma->vm_rb.rb_right,
1903 struct vm_area_struct, vm_rb);
1904 if (right->rb_subtree_gap >= length) {
1905 vma = right;
1906 continue;
1907 }
1908 }
1909
1910
1911 while (true) {
1912 struct rb_node *prev = &vma->vm_rb;
1913 if (!rb_parent(prev))
1914 goto check_highest;
1915 vma = rb_entry(rb_parent(prev),
1916 struct vm_area_struct, vm_rb);
1917 if (prev == vma->vm_rb.rb_left) {
1918 gap_start = vm_end_gap(vma->vm_prev);
1919 gap_end = vm_start_gap(vma);
1920 goto check_current;
1921 }
1922 }
1923 }
1924
1925check_highest:
1926
1927 gap_start = mm->highest_vm_end;
1928 gap_end = ULONG_MAX;
1929 if (gap_start > high_limit)
1930 return -ENOMEM;
1931
1932found:
1933
1934 if (gap_start < info->low_limit)
1935 gap_start = info->low_limit;
1936
1937
1938 gap_start += (info->align_offset - gap_start) & info->align_mask;
1939
1940 VM_BUG_ON(gap_start + info->length > info->high_limit);
1941 VM_BUG_ON(gap_start + info->length > gap_end);
1942 return gap_start;
1943}
1944
1945unsigned long unmapped_area_topdown(struct vm_unmapped_area_info *info)
1946{
1947 struct mm_struct *mm = current->mm;
1948 struct vm_area_struct *vma;
1949 unsigned long length, low_limit, high_limit, gap_start, gap_end;
1950
1951
1952 length = info->length + info->align_mask;
1953 if (length < info->length)
1954 return -ENOMEM;
1955
1956
1957
1958
1959
1960 gap_end = info->high_limit;
1961 if (gap_end < length)
1962 return -ENOMEM;
1963 high_limit = gap_end - length;
1964
1965 if (info->low_limit > high_limit)
1966 return -ENOMEM;
1967 low_limit = info->low_limit + length;
1968
1969
1970 gap_start = mm->highest_vm_end;
1971 if (gap_start <= high_limit)
1972 goto found_highest;
1973
1974
1975 if (RB_EMPTY_ROOT(&mm->mm_rb))
1976 return -ENOMEM;
1977 vma = rb_entry(mm->mm_rb.rb_node, struct vm_area_struct, vm_rb);
1978 if (vma->rb_subtree_gap < length)
1979 return -ENOMEM;
1980
1981 while (true) {
1982
1983 gap_start = vma->vm_prev ? vm_end_gap(vma->vm_prev) : 0;
1984 if (gap_start <= high_limit && vma->vm_rb.rb_right) {
1985 struct vm_area_struct *right =
1986 rb_entry(vma->vm_rb.rb_right,
1987 struct vm_area_struct, vm_rb);
1988 if (right->rb_subtree_gap >= length) {
1989 vma = right;
1990 continue;
1991 }
1992 }
1993
1994check_current:
1995
1996 gap_end = vm_start_gap(vma);
1997 if (gap_end < low_limit)
1998 return -ENOMEM;
1999 if (gap_start <= high_limit &&
2000 gap_end > gap_start && gap_end - gap_start >= length)
2001 goto found;
2002
2003
2004 if (vma->vm_rb.rb_left) {
2005 struct vm_area_struct *left =
2006 rb_entry(vma->vm_rb.rb_left,
2007 struct vm_area_struct, vm_rb);
2008 if (left->rb_subtree_gap >= length) {
2009 vma = left;
2010 continue;
2011 }
2012 }
2013
2014
2015 while (true) {
2016 struct rb_node *prev = &vma->vm_rb;
2017 if (!rb_parent(prev))
2018 return -ENOMEM;
2019 vma = rb_entry(rb_parent(prev),
2020 struct vm_area_struct, vm_rb);
2021 if (prev == vma->vm_rb.rb_right) {
2022 gap_start = vma->vm_prev ?
2023 vm_end_gap(vma->vm_prev) : 0;
2024 goto check_current;
2025 }
2026 }
2027 }
2028
2029found:
2030
2031 if (gap_end > info->high_limit)
2032 gap_end = info->high_limit;
2033
2034found_highest:
2035
2036 gap_end -= info->length;
2037 gap_end -= (gap_end - info->align_offset) & info->align_mask;
2038
2039 VM_BUG_ON(gap_end < info->low_limit);
2040 VM_BUG_ON(gap_end < gap_start);
2041 return gap_end;
2042}
2043
2044
2045
2046
2047
2048
2049
2050
2051
2052
2053
2054
2055#ifndef HAVE_ARCH_UNMAPPED_AREA
2056unsigned long
2057arch_get_unmapped_area(struct file *filp, unsigned long addr,
2058 unsigned long len, unsigned long pgoff, unsigned long flags)
2059{
2060 struct mm_struct *mm = current->mm;
2061 struct vm_area_struct *vma, *prev;
2062 struct vm_unmapped_area_info info;
2063
2064 if (len > TASK_SIZE - mmap_min_addr)
2065 return -ENOMEM;
2066
2067 if (flags & MAP_FIXED)
2068 return addr;
2069
2070 if (addr) {
2071 addr = PAGE_ALIGN(addr);
2072 vma = find_vma_prev(mm, addr, &prev);
2073 if (TASK_SIZE - len >= addr && addr >= mmap_min_addr &&
2074 (!vma || addr + len <= vm_start_gap(vma)) &&
2075 (!prev || addr >= vm_end_gap(prev)))
2076 return addr;
2077 }
2078
2079 info.flags = 0;
2080 info.length = len;
2081 info.low_limit = mm->mmap_base;
2082 info.high_limit = TASK_SIZE;
2083 info.align_mask = 0;
2084 return vm_unmapped_area(&info);
2085}
2086#endif
2087
2088
2089
2090
2091
2092#ifndef HAVE_ARCH_UNMAPPED_AREA_TOPDOWN
2093unsigned long
2094arch_get_unmapped_area_topdown(struct file *filp, const unsigned long addr0,
2095 const unsigned long len, const unsigned long pgoff,
2096 const unsigned long flags)
2097{
2098 struct vm_area_struct *vma, *prev;
2099 struct mm_struct *mm = current->mm;
2100 unsigned long addr = addr0;
2101 struct vm_unmapped_area_info info;
2102
2103
2104 if (len > TASK_SIZE - mmap_min_addr)
2105 return -ENOMEM;
2106
2107 if (flags & MAP_FIXED)
2108 return addr;
2109
2110
2111 if (addr) {
2112 addr = PAGE_ALIGN(addr);
2113 vma = find_vma_prev(mm, addr, &prev);
2114 if (TASK_SIZE - len >= addr && addr >= mmap_min_addr &&
2115 (!vma || addr + len <= vm_start_gap(vma)) &&
2116 (!prev || addr >= vm_end_gap(prev)))
2117 return addr;
2118 }
2119
2120 info.flags = VM_UNMAPPED_AREA_TOPDOWN;
2121 info.length = len;
2122 info.low_limit = max(PAGE_SIZE, mmap_min_addr);
2123 info.high_limit = mm->mmap_base;
2124 info.align_mask = 0;
2125 addr = vm_unmapped_area(&info);
2126
2127
2128
2129
2130
2131
2132
2133 if (offset_in_page(addr)) {
2134 VM_BUG_ON(addr != -ENOMEM);
2135 info.flags = 0;
2136 info.low_limit = TASK_UNMAPPED_BASE;
2137 info.high_limit = TASK_SIZE;
2138 addr = vm_unmapped_area(&info);
2139 }
2140
2141 return addr;
2142}
2143#endif
2144
2145unsigned long
2146get_unmapped_area(struct file *file, unsigned long addr, unsigned long len,
2147 unsigned long pgoff, unsigned long flags)
2148{
2149 unsigned long (*get_area)(struct file *, unsigned long,
2150 unsigned long, unsigned long, unsigned long);
2151
2152 unsigned long error = arch_mmap_check(addr, len, flags);
2153 if (error)
2154 return error;
2155
2156
2157 if (len > TASK_SIZE)
2158 return -ENOMEM;
2159
2160 get_area = current->mm->get_unmapped_area;
2161 if (file) {
2162 if (file->f_op->get_unmapped_area)
2163 get_area = file->f_op->get_unmapped_area;
2164 } else if (flags & MAP_SHARED) {
2165
2166
2167
2168
2169
2170 pgoff = 0;
2171 get_area = shmem_get_unmapped_area;
2172 }
2173
2174 addr = get_area(file, addr, len, pgoff, flags);
2175 if (IS_ERR_VALUE(addr))
2176 return addr;
2177
2178 if (addr > TASK_SIZE - len)
2179 return -ENOMEM;
2180 if (offset_in_page(addr))
2181 return -EINVAL;
2182
2183 error = security_mmap_addr(addr);
2184 return error ? error : addr;
2185}
2186
2187EXPORT_SYMBOL(get_unmapped_area);
2188
2189
2190struct vm_area_struct *find_vma(struct mm_struct *mm, unsigned long addr)
2191{
2192 struct rb_node *rb_node;
2193 struct vm_area_struct *vma;
2194
2195
2196 vma = vmacache_find(mm, addr);
2197 if (likely(vma))
2198 return vma;
2199
2200 rb_node = mm->mm_rb.rb_node;
2201
2202 while (rb_node) {
2203 struct vm_area_struct *tmp;
2204
2205 tmp = rb_entry(rb_node, struct vm_area_struct, vm_rb);
2206
2207 if (tmp->vm_end > addr) {
2208 vma = tmp;
2209 if (tmp->vm_start <= addr)
2210 break;
2211 rb_node = rb_node->rb_left;
2212 } else
2213 rb_node = rb_node->rb_right;
2214 }
2215
2216 if (vma)
2217 vmacache_update(addr, vma);
2218 return vma;
2219}
2220
2221EXPORT_SYMBOL(find_vma);
2222
2223
2224
2225
2226struct vm_area_struct *
2227find_vma_prev(struct mm_struct *mm, unsigned long addr,
2228 struct vm_area_struct **pprev)
2229{
2230 struct vm_area_struct *vma;
2231
2232 vma = find_vma(mm, addr);
2233 if (vma) {
2234 *pprev = vma->vm_prev;
2235 } else {
2236 struct rb_node *rb_node = mm->mm_rb.rb_node;
2237 *pprev = NULL;
2238 while (rb_node) {
2239 *pprev = rb_entry(rb_node, struct vm_area_struct, vm_rb);
2240 rb_node = rb_node->rb_right;
2241 }
2242 }
2243 return vma;
2244}
2245
2246
2247
2248
2249
2250
2251static int acct_stack_growth(struct vm_area_struct *vma,
2252 unsigned long size, unsigned long grow)
2253{
2254 struct mm_struct *mm = vma->vm_mm;
2255 unsigned long new_start;
2256
2257
2258 if (!may_expand_vm(mm, vma->vm_flags, grow))
2259 return -ENOMEM;
2260
2261
2262 if (size > rlimit(RLIMIT_STACK))
2263 return -ENOMEM;
2264
2265
2266 if (vma->vm_flags & VM_LOCKED) {
2267 unsigned long locked;
2268 unsigned long limit;
2269 locked = mm->locked_vm + grow;
2270 limit = rlimit(RLIMIT_MEMLOCK);
2271 limit >>= PAGE_SHIFT;
2272 if (locked > limit && !capable(CAP_IPC_LOCK))
2273 return -ENOMEM;
2274 }
2275
2276
2277 new_start = (vma->vm_flags & VM_GROWSUP) ? vma->vm_start :
2278 vma->vm_end - size;
2279 if (is_hugepage_only_range(vma->vm_mm, new_start, size))
2280 return -EFAULT;
2281
2282
2283
2284
2285
2286 if (security_vm_enough_memory_mm(mm, grow))
2287 return -ENOMEM;
2288
2289 return 0;
2290}
2291
2292#if defined(CONFIG_STACK_GROWSUP) || defined(CONFIG_IA64)
2293
2294
2295
2296
2297int expand_upwards(struct vm_area_struct *vma, unsigned long address)
2298{
2299 struct mm_struct *mm = vma->vm_mm;
2300 struct vm_area_struct *next;
2301 unsigned long gap_addr;
2302 int error = 0;
2303
2304 if (!(vma->vm_flags & VM_GROWSUP))
2305 return -EFAULT;
2306
2307
2308 address &= PAGE_MASK;
2309 if (address >= (TASK_SIZE & PAGE_MASK))
2310 return -ENOMEM;
2311 address += PAGE_SIZE;
2312
2313
2314 gap_addr = address + stack_guard_gap;
2315
2316
2317 if (gap_addr < address || gap_addr > TASK_SIZE)
2318 gap_addr = TASK_SIZE;
2319
2320 next = vma->vm_next;
2321 if (next && next->vm_start < gap_addr &&
2322 (next->vm_flags & (VM_WRITE|VM_READ|VM_EXEC))) {
2323 if (!(next->vm_flags & VM_GROWSUP))
2324 return -ENOMEM;
2325
2326 }
2327
2328
2329 if (unlikely(anon_vma_prepare(vma)))
2330 return -ENOMEM;
2331
2332
2333
2334
2335
2336
2337 anon_vma_lock_write(vma->anon_vma);
2338
2339
2340 if (address > vma->vm_end) {
2341 unsigned long size, grow;
2342
2343 size = address - vma->vm_start;
2344 grow = (address - vma->vm_end) >> PAGE_SHIFT;
2345
2346 error = -ENOMEM;
2347 if (vma->vm_pgoff + (size >> PAGE_SHIFT) >= vma->vm_pgoff) {
2348 error = acct_stack_growth(vma, size, grow);
2349 if (!error) {
2350
2351
2352
2353
2354
2355
2356
2357
2358
2359
2360
2361 spin_lock(&mm->page_table_lock);
2362 if (vma->vm_flags & VM_LOCKED)
2363 mm->locked_vm += grow;
2364 vm_stat_account(mm, vma->vm_flags, grow);
2365 anon_vma_interval_tree_pre_update_vma(vma);
2366 vma->vm_end = address;
2367 anon_vma_interval_tree_post_update_vma(vma);
2368 if (vma->vm_next)
2369 vma_gap_update(vma->vm_next);
2370 else
2371 mm->highest_vm_end = vm_end_gap(vma);
2372 spin_unlock(&mm->page_table_lock);
2373
2374 perf_event_mmap(vma);
2375 }
2376 }
2377 }
2378 anon_vma_unlock_write(vma->anon_vma);
2379 khugepaged_enter_vma_merge(vma, vma->vm_flags);
2380 validate_mm(mm);
2381 return error;
2382}
2383#endif
2384
2385
2386
2387
2388int expand_downwards(struct vm_area_struct *vma,
2389 unsigned long address)
2390{
2391 struct mm_struct *mm = vma->vm_mm;
2392 struct vm_area_struct *prev;
2393 int error;
2394
2395 address &= PAGE_MASK;
2396 error = security_mmap_addr(address);
2397 if (error)
2398 return error;
2399
2400
2401 prev = vma->vm_prev;
2402
2403 if (prev && !(prev->vm_flags & VM_GROWSDOWN) &&
2404 (prev->vm_flags & (VM_WRITE|VM_READ|VM_EXEC))) {
2405 if (address - prev->vm_end < stack_guard_gap)
2406 return -ENOMEM;
2407 }
2408
2409
2410 if (unlikely(anon_vma_prepare(vma)))
2411 return -ENOMEM;
2412
2413
2414
2415
2416
2417
2418 anon_vma_lock_write(vma->anon_vma);
2419
2420
2421 if (address < vma->vm_start) {
2422 unsigned long size, grow;
2423
2424 size = vma->vm_end - address;
2425 grow = (vma->vm_start - address) >> PAGE_SHIFT;
2426
2427 error = -ENOMEM;
2428 if (grow <= vma->vm_pgoff) {
2429 error = acct_stack_growth(vma, size, grow);
2430 if (!error) {
2431
2432
2433
2434
2435
2436
2437
2438
2439
2440
2441
2442 spin_lock(&mm->page_table_lock);
2443 if (vma->vm_flags & VM_LOCKED)
2444 mm->locked_vm += grow;
2445 vm_stat_account(mm, vma->vm_flags, grow);
2446 anon_vma_interval_tree_pre_update_vma(vma);
2447 vma->vm_start = address;
2448 vma->vm_pgoff -= grow;
2449 anon_vma_interval_tree_post_update_vma(vma);
2450 vma_gap_update(vma);
2451 spin_unlock(&mm->page_table_lock);
2452
2453 perf_event_mmap(vma);
2454 }
2455 }
2456 }
2457 anon_vma_unlock_write(vma->anon_vma);
2458 khugepaged_enter_vma_merge(vma, vma->vm_flags);
2459 validate_mm(mm);
2460 return error;
2461}
2462
2463
2464unsigned long stack_guard_gap = 256UL<<PAGE_SHIFT;
2465
2466static int __init cmdline_parse_stack_guard_gap(char *p)
2467{
2468 unsigned long val;
2469 char *endptr;
2470
2471 val = simple_strtoul(p, &endptr, 10);
2472 if (!*endptr)
2473 stack_guard_gap = val << PAGE_SHIFT;
2474
2475 return 0;
2476}
2477__setup("stack_guard_gap=", cmdline_parse_stack_guard_gap);
2478
2479#ifdef CONFIG_STACK_GROWSUP
2480int expand_stack(struct vm_area_struct *vma, unsigned long address)
2481{
2482 return expand_upwards(vma, address);
2483}
2484
2485struct vm_area_struct *
2486find_extend_vma(struct mm_struct *mm, unsigned long addr)
2487{
2488 struct vm_area_struct *vma, *prev;
2489
2490 addr &= PAGE_MASK;
2491 vma = find_vma_prev(mm, addr, &prev);
2492 if (vma && (vma->vm_start <= addr))
2493 return vma;
2494 if (!prev || expand_stack(prev, addr))
2495 return NULL;
2496 if (prev->vm_flags & VM_LOCKED)
2497 populate_vma_page_range(prev, addr, prev->vm_end, NULL);
2498 return prev;
2499}
2500#else
2501int expand_stack(struct vm_area_struct *vma, unsigned long address)
2502{
2503 return expand_downwards(vma, address);
2504}
2505
2506struct vm_area_struct *
2507find_extend_vma(struct mm_struct *mm, unsigned long addr)
2508{
2509 struct vm_area_struct *vma;
2510 unsigned long start;
2511
2512 addr &= PAGE_MASK;
2513 vma = find_vma(mm, addr);
2514 if (!vma)
2515 return NULL;
2516 if (vma->vm_start <= addr)
2517 return vma;
2518 if (!(vma->vm_flags & VM_GROWSDOWN))
2519 return NULL;
2520 start = vma->vm_start;
2521 if (expand_stack(vma, addr))
2522 return NULL;
2523 if (vma->vm_flags & VM_LOCKED)
2524 populate_vma_page_range(vma, addr, start, NULL);
2525 return vma;
2526}
2527#endif
2528
2529EXPORT_SYMBOL_GPL(find_extend_vma);
2530
2531
2532
2533
2534
2535
2536
2537static void remove_vma_list(struct mm_struct *mm, struct vm_area_struct *vma)
2538{
2539 unsigned long nr_accounted = 0;
2540
2541
2542 update_hiwater_vm(mm);
2543 do {
2544 long nrpages = vma_pages(vma);
2545
2546 if (vma->vm_flags & VM_ACCOUNT)
2547 nr_accounted += nrpages;
2548 vm_stat_account(mm, vma->vm_flags, -nrpages);
2549 vma = remove_vma(vma);
2550 } while (vma);
2551 vm_unacct_memory(nr_accounted);
2552 validate_mm(mm);
2553}
2554
2555
2556
2557
2558
2559
2560static void unmap_region(struct mm_struct *mm,
2561 struct vm_area_struct *vma, struct vm_area_struct *prev,
2562 unsigned long start, unsigned long end)
2563{
2564 struct vm_area_struct *next = prev ? prev->vm_next : mm->mmap;
2565 struct mmu_gather tlb;
2566
2567 lru_add_drain();
2568 tlb_gather_mmu(&tlb, mm, start, end);
2569 update_hiwater_rss(mm);
2570 unmap_vmas(&tlb, vma, start, end);
2571 free_pgtables(&tlb, vma, prev ? prev->vm_end : FIRST_USER_ADDRESS,
2572 next ? next->vm_start : USER_PGTABLES_CEILING);
2573 tlb_finish_mmu(&tlb, start, end);
2574}
2575
2576
2577
2578
2579
2580static void
2581detach_vmas_to_be_unmapped(struct mm_struct *mm, struct vm_area_struct *vma,
2582 struct vm_area_struct *prev, unsigned long end)
2583{
2584 struct vm_area_struct **insertion_point;
2585 struct vm_area_struct *tail_vma = NULL;
2586
2587 insertion_point = (prev ? &prev->vm_next : &mm->mmap);
2588 vma->vm_prev = NULL;
2589 do {
2590 vma_rb_erase(vma, &mm->mm_rb);
2591 mm->map_count--;
2592 tail_vma = vma;
2593 vma = vma->vm_next;
2594 } while (vma && vma->vm_start < end);
2595 *insertion_point = vma;
2596 if (vma) {
2597 vma->vm_prev = prev;
2598 vma_gap_update(vma);
2599 } else
2600 mm->highest_vm_end = prev ? vm_end_gap(prev) : 0;
2601 tail_vma->vm_next = NULL;
2602
2603
2604 vmacache_invalidate(mm);
2605}
2606
2607
2608
2609
2610
2611int __split_vma(struct mm_struct *mm, struct vm_area_struct *vma,
2612 unsigned long addr, int new_below)
2613{
2614 struct vm_area_struct *new;
2615 int err;
2616
2617 if (vma->vm_ops && vma->vm_ops->split) {
2618 err = vma->vm_ops->split(vma, addr);
2619 if (err)
2620 return err;
2621 }
2622
2623 new = kmem_cache_alloc(vm_area_cachep, GFP_KERNEL);
2624 if (!new)
2625 return -ENOMEM;
2626
2627
2628 *new = *vma;
2629
2630 INIT_LIST_HEAD(&new->anon_vma_chain);
2631
2632 if (new_below)
2633 new->vm_end = addr;
2634 else {
2635 new->vm_start = addr;
2636 new->vm_pgoff += ((addr - vma->vm_start) >> PAGE_SHIFT);
2637 }
2638
2639 err = vma_dup_policy(vma, new);
2640 if (err)
2641 goto out_free_vma;
2642
2643 err = anon_vma_clone(new, vma);
2644 if (err)
2645 goto out_free_mpol;
2646
2647 if (new->vm_file)
2648 get_file(new->vm_file);
2649
2650 if (new->vm_ops && new->vm_ops->open)
2651 new->vm_ops->open(new);
2652
2653 if (new_below)
2654 err = vma_adjust(vma, addr, vma->vm_end, vma->vm_pgoff +
2655 ((addr - new->vm_start) >> PAGE_SHIFT), new);
2656 else
2657 err = vma_adjust(vma, vma->vm_start, addr, vma->vm_pgoff, new);
2658
2659
2660 if (!err)
2661 return 0;
2662
2663
2664 if (new->vm_ops && new->vm_ops->close)
2665 new->vm_ops->close(new);
2666 if (new->vm_file)
2667 fput(new->vm_file);
2668 unlink_anon_vmas(new);
2669 out_free_mpol:
2670 mpol_put(vma_policy(new));
2671 out_free_vma:
2672 kmem_cache_free(vm_area_cachep, new);
2673 return err;
2674}
2675
2676
2677
2678
2679
2680int split_vma(struct mm_struct *mm, struct vm_area_struct *vma,
2681 unsigned long addr, int new_below)
2682{
2683 if (mm->map_count >= sysctl_max_map_count)
2684 return -ENOMEM;
2685
2686 return __split_vma(mm, vma, addr, new_below);
2687}
2688
2689
2690
2691
2692
2693
2694int do_munmap(struct mm_struct *mm, unsigned long start, size_t len,
2695 struct list_head *uf)
2696{
2697 unsigned long end;
2698 struct vm_area_struct *vma, *prev, *last;
2699
2700 if ((offset_in_page(start)) || start > TASK_SIZE || len > TASK_SIZE-start)
2701 return -EINVAL;
2702
2703 len = PAGE_ALIGN(len);
2704 if (len == 0)
2705 return -EINVAL;
2706
2707
2708 vma = find_vma(mm, start);
2709 if (!vma)
2710 return 0;
2711 prev = vma->vm_prev;
2712
2713
2714
2715 end = start + len;
2716 if (vma->vm_start >= end)
2717 return 0;
2718
2719
2720
2721
2722
2723
2724
2725
2726 if (start > vma->vm_start) {
2727 int error;
2728
2729
2730
2731
2732
2733
2734 if (end < vma->vm_end && mm->map_count >= sysctl_max_map_count)
2735 return -ENOMEM;
2736
2737 error = __split_vma(mm, vma, start, 0);
2738 if (error)
2739 return error;
2740 prev = vma;
2741 }
2742
2743
2744 last = find_vma(mm, end);
2745 if (last && end > last->vm_start) {
2746 int error = __split_vma(mm, last, end, 1);
2747 if (error)
2748 return error;
2749 }
2750 vma = prev ? prev->vm_next : mm->mmap;
2751
2752 if (unlikely(uf)) {
2753
2754
2755
2756
2757
2758
2759
2760
2761
2762 int error = userfaultfd_unmap_prep(vma, start, end, uf);
2763 if (error)
2764 return error;
2765 }
2766
2767
2768
2769
2770 if (mm->locked_vm) {
2771 struct vm_area_struct *tmp = vma;
2772 while (tmp && tmp->vm_start < end) {
2773 if (tmp->vm_flags & VM_LOCKED) {
2774 mm->locked_vm -= vma_pages(tmp);
2775 munlock_vma_pages_all(tmp);
2776 }
2777 tmp = tmp->vm_next;
2778 }
2779 }
2780
2781
2782
2783
2784 detach_vmas_to_be_unmapped(mm, vma, prev, end);
2785 unmap_region(mm, vma, prev, start, end);
2786
2787 arch_unmap(mm, vma, start, end);
2788
2789
2790 remove_vma_list(mm, vma);
2791
2792 return 0;
2793}
2794
2795int vm_munmap(unsigned long start, size_t len)
2796{
2797 int ret;
2798 struct mm_struct *mm = current->mm;
2799 LIST_HEAD(uf);
2800
2801 if (down_write_killable(&mm->mmap_sem))
2802 return -EINTR;
2803
2804 ret = do_munmap(mm, start, len, &uf);
2805 up_write(&mm->mmap_sem);
2806 userfaultfd_unmap_complete(mm, &uf);
2807 return ret;
2808}
2809EXPORT_SYMBOL(vm_munmap);
2810
2811SYSCALL_DEFINE2(munmap, unsigned long, addr, size_t, len)
2812{
2813 profile_munmap(addr);
2814 return vm_munmap(addr, len);
2815}
2816
2817
2818
2819
2820
2821SYSCALL_DEFINE5(remap_file_pages, unsigned long, start, unsigned long, size,
2822 unsigned long, prot, unsigned long, pgoff, unsigned long, flags)
2823{
2824
2825 struct mm_struct *mm = current->mm;
2826 struct vm_area_struct *vma;
2827 unsigned long populate = 0;
2828 unsigned long ret = -EINVAL;
2829 struct file *file;
2830
2831 pr_warn_once("%s (%d) uses deprecated remap_file_pages() syscall. See Documentation/vm/remap_file_pages.txt.\n",
2832 current->comm, current->pid);
2833
2834 if (prot)
2835 return ret;
2836 start = start & PAGE_MASK;
2837 size = size & PAGE_MASK;
2838
2839 if (start + size <= start)
2840 return ret;
2841
2842
2843 if (pgoff + (size >> PAGE_SHIFT) < pgoff)
2844 return ret;
2845
2846 if (down_write_killable(&mm->mmap_sem))
2847 return -EINTR;
2848
2849 vma = find_vma(mm, start);
2850
2851 if (!vma || !(vma->vm_flags & VM_SHARED))
2852 goto out;
2853
2854 if (start < vma->vm_start)
2855 goto out;
2856
2857 if (start + size > vma->vm_end) {
2858 struct vm_area_struct *next;
2859
2860 for (next = vma->vm_next; next; next = next->vm_next) {
2861
2862 if (next->vm_start != next->vm_prev->vm_end)
2863 goto out;
2864
2865 if (next->vm_file != vma->vm_file)
2866 goto out;
2867
2868 if (next->vm_flags != vma->vm_flags)
2869 goto out;
2870
2871 if (start + size <= next->vm_end)
2872 break;
2873 }
2874
2875 if (!next)
2876 goto out;
2877 }
2878
2879 prot |= vma->vm_flags & VM_READ ? PROT_READ : 0;
2880 prot |= vma->vm_flags & VM_WRITE ? PROT_WRITE : 0;
2881 prot |= vma->vm_flags & VM_EXEC ? PROT_EXEC : 0;
2882
2883 flags &= MAP_NONBLOCK;
2884 flags |= MAP_SHARED | MAP_FIXED | MAP_POPULATE;
2885 if (vma->vm_flags & VM_LOCKED) {
2886 struct vm_area_struct *tmp;
2887 flags |= MAP_LOCKED;
2888
2889
2890 for (tmp = vma; tmp->vm_start >= start + size;
2891 tmp = tmp->vm_next) {
2892
2893
2894
2895
2896 vma_adjust_trans_huge(tmp, start, start + size, 0);
2897
2898 munlock_vma_pages_range(tmp,
2899 max(tmp->vm_start, start),
2900 min(tmp->vm_end, start + size));
2901 }
2902 }
2903
2904 file = get_file(vma->vm_file);
2905 ret = do_mmap_pgoff(vma->vm_file, start, size,
2906 prot, flags, pgoff, &populate, NULL);
2907 fput(file);
2908out:
2909 up_write(&mm->mmap_sem);
2910 if (populate)
2911 mm_populate(ret, populate);
2912 if (!IS_ERR_VALUE(ret))
2913 ret = 0;
2914 return ret;
2915}
2916
2917static inline void verify_mm_writelocked(struct mm_struct *mm)
2918{
2919#ifdef CONFIG_DEBUG_VM
2920 if (unlikely(down_read_trylock(&mm->mmap_sem))) {
2921 WARN_ON(1);
2922 up_read(&mm->mmap_sem);
2923 }
2924#endif
2925}
2926
2927
2928
2929
2930
2931
2932static int do_brk_flags(unsigned long addr, unsigned long request, unsigned long flags, struct list_head *uf)
2933{
2934 struct mm_struct *mm = current->mm;
2935 struct vm_area_struct *vma, *prev;
2936 unsigned long len;
2937 struct rb_node **rb_link, *rb_parent;
2938 pgoff_t pgoff = addr >> PAGE_SHIFT;
2939 int error;
2940
2941 len = PAGE_ALIGN(request);
2942 if (len < request)
2943 return -ENOMEM;
2944 if (!len)
2945 return 0;
2946
2947
2948 if ((flags & (~VM_EXEC)) != 0)
2949 return -EINVAL;
2950 flags |= VM_DATA_DEFAULT_FLAGS | VM_ACCOUNT | mm->def_flags;
2951
2952 error = get_unmapped_area(NULL, addr, len, 0, MAP_FIXED);
2953 if (offset_in_page(error))
2954 return error;
2955
2956 error = mlock_future_check(mm, mm->def_flags, len);
2957 if (error)
2958 return error;
2959
2960
2961
2962
2963
2964 verify_mm_writelocked(mm);
2965
2966
2967
2968
2969 while (find_vma_links(mm, addr, addr + len, &prev, &rb_link,
2970 &rb_parent)) {
2971 if (do_munmap(mm, addr, len, uf))
2972 return -ENOMEM;
2973 }
2974
2975
2976 if (!may_expand_vm(mm, flags, len >> PAGE_SHIFT))
2977 return -ENOMEM;
2978
2979 if (mm->map_count > sysctl_max_map_count)
2980 return -ENOMEM;
2981
2982 if (security_vm_enough_memory_mm(mm, len >> PAGE_SHIFT))
2983 return -ENOMEM;
2984
2985
2986 vma = vma_merge(mm, prev, addr, addr + len, flags,
2987 NULL, NULL, pgoff, NULL, NULL_VM_UFFD_CTX);
2988 if (vma)
2989 goto out;
2990
2991
2992
2993
2994 vma = kmem_cache_zalloc(vm_area_cachep, GFP_KERNEL);
2995 if (!vma) {
2996 vm_unacct_memory(len >> PAGE_SHIFT);
2997 return -ENOMEM;
2998 }
2999
3000 INIT_LIST_HEAD(&vma->anon_vma_chain);
3001 vma->vm_mm = mm;
3002 vma->vm_start = addr;
3003 vma->vm_end = addr + len;
3004 vma->vm_pgoff = pgoff;
3005 vma->vm_flags = flags;
3006 vma->vm_page_prot = vm_get_page_prot(flags);
3007 vma_link(mm, vma, prev, rb_link, rb_parent);
3008out:
3009 perf_event_mmap(vma);
3010 mm->total_vm += len >> PAGE_SHIFT;
3011 mm->data_vm += len >> PAGE_SHIFT;
3012 if (flags & VM_LOCKED)
3013 mm->locked_vm += (len >> PAGE_SHIFT);
3014 vma->vm_flags |= VM_SOFTDIRTY;
3015 return 0;
3016}
3017
3018static int do_brk(unsigned long addr, unsigned long len, struct list_head *uf)
3019{
3020 return do_brk_flags(addr, len, 0, uf);
3021}
3022
3023int vm_brk_flags(unsigned long addr, unsigned long len, unsigned long flags)
3024{
3025 struct mm_struct *mm = current->mm;
3026 int ret;
3027 bool populate;
3028 LIST_HEAD(uf);
3029
3030 if (down_write_killable(&mm->mmap_sem))
3031 return -EINTR;
3032
3033 ret = do_brk_flags(addr, len, flags, &uf);
3034 populate = ((mm->def_flags & VM_LOCKED) != 0);
3035 up_write(&mm->mmap_sem);
3036 userfaultfd_unmap_complete(mm, &uf);
3037 if (populate && !ret)
3038 mm_populate(addr, len);
3039 return ret;
3040}
3041EXPORT_SYMBOL(vm_brk_flags);
3042
3043int vm_brk(unsigned long addr, unsigned long len)
3044{
3045 return vm_brk_flags(addr, len, 0);
3046}
3047EXPORT_SYMBOL(vm_brk);
3048
3049
3050void exit_mmap(struct mm_struct *mm)
3051{
3052 struct mmu_gather tlb;
3053 struct vm_area_struct *vma;
3054 unsigned long nr_accounted = 0;
3055
3056
3057 mmu_notifier_release(mm);
3058
3059 if (unlikely(mm_is_oom_victim(mm))) {
3060
3061
3062
3063
3064
3065
3066
3067
3068
3069
3070
3071
3072
3073
3074
3075
3076 mutex_lock(&oom_lock);
3077 __oom_reap_task_mm(mm);
3078 mutex_unlock(&oom_lock);
3079
3080 set_bit(MMF_OOM_SKIP, &mm->flags);
3081 down_write(&mm->mmap_sem);
3082 up_write(&mm->mmap_sem);
3083 }
3084
3085 if (mm->locked_vm) {
3086 vma = mm->mmap;
3087 while (vma) {
3088 if (vma->vm_flags & VM_LOCKED)
3089 munlock_vma_pages_all(vma);
3090 vma = vma->vm_next;
3091 }
3092 }
3093
3094 arch_exit_mmap(mm);
3095
3096 vma = mm->mmap;
3097 if (!vma)
3098 return;
3099
3100 lru_add_drain();
3101 flush_cache_mm(mm);
3102 tlb_gather_mmu(&tlb, mm, 0, -1);
3103
3104
3105 unmap_vmas(&tlb, vma, 0, -1);
3106 free_pgtables(&tlb, vma, FIRST_USER_ADDRESS, USER_PGTABLES_CEILING);
3107 tlb_finish_mmu(&tlb, 0, -1);
3108
3109
3110
3111
3112
3113 while (vma) {
3114 if (vma->vm_flags & VM_ACCOUNT)
3115 nr_accounted += vma_pages(vma);
3116 vma = remove_vma(vma);
3117 }
3118 vm_unacct_memory(nr_accounted);
3119}
3120
3121
3122
3123
3124
3125int insert_vm_struct(struct mm_struct *mm, struct vm_area_struct *vma)
3126{
3127 struct vm_area_struct *prev;
3128 struct rb_node **rb_link, *rb_parent;
3129
3130 if (find_vma_links(mm, vma->vm_start, vma->vm_end,
3131 &prev, &rb_link, &rb_parent))
3132 return -ENOMEM;
3133 if ((vma->vm_flags & VM_ACCOUNT) &&
3134 security_vm_enough_memory_mm(mm, vma_pages(vma)))
3135 return -ENOMEM;
3136
3137
3138
3139
3140
3141
3142
3143
3144
3145
3146
3147
3148
3149 if (vma_is_anonymous(vma)) {
3150 BUG_ON(vma->anon_vma);
3151 vma->vm_pgoff = vma->vm_start >> PAGE_SHIFT;
3152 }
3153
3154 vma_link(mm, vma, prev, rb_link, rb_parent);
3155 return 0;
3156}
3157
3158
3159
3160
3161
3162struct vm_area_struct *copy_vma(struct vm_area_struct **vmap,
3163 unsigned long addr, unsigned long len, pgoff_t pgoff,
3164 bool *need_rmap_locks)
3165{
3166 struct vm_area_struct *vma = *vmap;
3167 unsigned long vma_start = vma->vm_start;
3168 struct mm_struct *mm = vma->vm_mm;
3169 struct vm_area_struct *new_vma, *prev;
3170 struct rb_node **rb_link, *rb_parent;
3171 bool faulted_in_anon_vma = true;
3172
3173
3174
3175
3176
3177 if (unlikely(vma_is_anonymous(vma) && !vma->anon_vma)) {
3178 pgoff = addr >> PAGE_SHIFT;
3179 faulted_in_anon_vma = false;
3180 }
3181
3182 if (find_vma_links(mm, addr, addr + len, &prev, &rb_link, &rb_parent))
3183 return NULL;
3184 new_vma = vma_merge(mm, prev, addr, addr + len, vma->vm_flags,
3185 vma->anon_vma, vma->vm_file, pgoff, vma_policy(vma),
3186 vma->vm_userfaultfd_ctx);
3187 if (new_vma) {
3188
3189
3190
3191 if (unlikely(vma_start >= new_vma->vm_start &&
3192 vma_start < new_vma->vm_end)) {
3193
3194
3195
3196
3197
3198
3199
3200
3201
3202
3203
3204
3205 VM_BUG_ON_VMA(faulted_in_anon_vma, new_vma);
3206 *vmap = vma = new_vma;
3207 }
3208 *need_rmap_locks = (new_vma->vm_pgoff <= vma->vm_pgoff);
3209 } else {
3210 new_vma = kmem_cache_alloc(vm_area_cachep, GFP_KERNEL);
3211 if (!new_vma)
3212 goto out;
3213 *new_vma = *vma;
3214 new_vma->vm_start = addr;
3215 new_vma->vm_end = addr + len;
3216 new_vma->vm_pgoff = pgoff;
3217 if (vma_dup_policy(vma, new_vma))
3218 goto out_free_vma;
3219 INIT_LIST_HEAD(&new_vma->anon_vma_chain);
3220 if (anon_vma_clone(new_vma, vma))
3221 goto out_free_mempol;
3222 if (new_vma->vm_file)
3223 get_file(new_vma->vm_file);
3224 if (new_vma->vm_ops && new_vma->vm_ops->open)
3225 new_vma->vm_ops->open(new_vma);
3226 vma_link(mm, new_vma, prev, rb_link, rb_parent);
3227 *need_rmap_locks = false;
3228 }
3229 return new_vma;
3230
3231out_free_mempol:
3232 mpol_put(vma_policy(new_vma));
3233out_free_vma:
3234 kmem_cache_free(vm_area_cachep, new_vma);
3235out:
3236 return NULL;
3237}
3238
3239
3240
3241
3242
3243bool may_expand_vm(struct mm_struct *mm, vm_flags_t flags, unsigned long npages)
3244{
3245 if (mm->total_vm + npages > rlimit(RLIMIT_AS) >> PAGE_SHIFT)
3246 return false;
3247
3248 if (is_data_mapping(flags) &&
3249 mm->data_vm + npages > rlimit(RLIMIT_DATA) >> PAGE_SHIFT) {
3250
3251 if (rlimit(RLIMIT_DATA) == 0 &&
3252 mm->data_vm + npages <= rlimit_max(RLIMIT_DATA) >> PAGE_SHIFT)
3253 return true;
3254
3255 pr_warn_once("%s (%d): VmData %lu exceed data ulimit %lu. Update limits%s.\n",
3256 current->comm, current->pid,
3257 (mm->data_vm + npages) << PAGE_SHIFT,
3258 rlimit(RLIMIT_DATA),
3259 ignore_rlimit_data ? "" : " or use boot option ignore_rlimit_data");
3260
3261 if (!ignore_rlimit_data)
3262 return false;
3263 }
3264
3265 return true;
3266}
3267
3268void vm_stat_account(struct mm_struct *mm, vm_flags_t flags, long npages)
3269{
3270 mm->total_vm += npages;
3271
3272 if (is_exec_mapping(flags))
3273 mm->exec_vm += npages;
3274 else if (is_stack_mapping(flags))
3275 mm->stack_vm += npages;
3276 else if (is_data_mapping(flags))
3277 mm->data_vm += npages;
3278}
3279
3280static int special_mapping_fault(struct vm_fault *vmf);
3281
3282
3283
3284
3285static void special_mapping_close(struct vm_area_struct *vma)
3286{
3287}
3288
3289static const char *special_mapping_name(struct vm_area_struct *vma)
3290{
3291 return ((struct vm_special_mapping *)vma->vm_private_data)->name;
3292}
3293
3294static int special_mapping_mremap(struct vm_area_struct *new_vma)
3295{
3296 struct vm_special_mapping *sm = new_vma->vm_private_data;
3297
3298 if (WARN_ON_ONCE(current->mm != new_vma->vm_mm))
3299 return -EFAULT;
3300
3301 if (sm->mremap)
3302 return sm->mremap(sm, new_vma);
3303
3304 return 0;
3305}
3306
3307static const struct vm_operations_struct special_mapping_vmops = {
3308 .close = special_mapping_close,
3309 .fault = special_mapping_fault,
3310 .mremap = special_mapping_mremap,
3311 .name = special_mapping_name,
3312};
3313
3314static const struct vm_operations_struct legacy_special_mapping_vmops = {
3315 .close = special_mapping_close,
3316 .fault = special_mapping_fault,
3317};
3318
3319static int special_mapping_fault(struct vm_fault *vmf)
3320{
3321 struct vm_area_struct *vma = vmf->vma;
3322 pgoff_t pgoff;
3323 struct page **pages;
3324
3325 if (vma->vm_ops == &legacy_special_mapping_vmops) {
3326 pages = vma->vm_private_data;
3327 } else {
3328 struct vm_special_mapping *sm = vma->vm_private_data;
3329
3330 if (sm->fault)
3331 return sm->fault(sm, vmf->vma, vmf);
3332
3333 pages = sm->pages;
3334 }
3335
3336 for (pgoff = vmf->pgoff; pgoff && *pages; ++pages)
3337 pgoff--;
3338
3339 if (*pages) {
3340 struct page *page = *pages;
3341 get_page(page);
3342 vmf->page = page;
3343 return 0;
3344 }
3345
3346 return VM_FAULT_SIGBUS;
3347}
3348
3349static struct vm_area_struct *__install_special_mapping(
3350 struct mm_struct *mm,
3351 unsigned long addr, unsigned long len,
3352 unsigned long vm_flags, void *priv,
3353 const struct vm_operations_struct *ops)
3354{
3355 int ret;
3356 struct vm_area_struct *vma;
3357
3358 vma = kmem_cache_zalloc(vm_area_cachep, GFP_KERNEL);
3359 if (unlikely(vma == NULL))
3360 return ERR_PTR(-ENOMEM);
3361
3362 INIT_LIST_HEAD(&vma->anon_vma_chain);
3363 vma->vm_mm = mm;
3364 vma->vm_start = addr;
3365 vma->vm_end = addr + len;
3366
3367 vma->vm_flags = vm_flags | mm->def_flags | VM_DONTEXPAND | VM_SOFTDIRTY;
3368 vma->vm_page_prot = vm_get_page_prot(vma->vm_flags);
3369
3370 vma->vm_ops = ops;
3371 vma->vm_private_data = priv;
3372
3373 ret = insert_vm_struct(mm, vma);
3374 if (ret)
3375 goto out;
3376
3377 vm_stat_account(mm, vma->vm_flags, len >> PAGE_SHIFT);
3378
3379 perf_event_mmap(vma);
3380
3381 return vma;
3382
3383out:
3384 kmem_cache_free(vm_area_cachep, vma);
3385 return ERR_PTR(ret);
3386}
3387
3388bool vma_is_special_mapping(const struct vm_area_struct *vma,
3389 const struct vm_special_mapping *sm)
3390{
3391 return vma->vm_private_data == sm &&
3392 (vma->vm_ops == &special_mapping_vmops ||
3393 vma->vm_ops == &legacy_special_mapping_vmops);
3394}
3395
3396
3397
3398
3399
3400
3401
3402
3403
3404
3405struct vm_area_struct *_install_special_mapping(
3406 struct mm_struct *mm,
3407 unsigned long addr, unsigned long len,
3408 unsigned long vm_flags, const struct vm_special_mapping *spec)
3409{
3410 return __install_special_mapping(mm, addr, len, vm_flags, (void *)spec,
3411 &special_mapping_vmops);
3412}
3413
3414int install_special_mapping(struct mm_struct *mm,
3415 unsigned long addr, unsigned long len,
3416 unsigned long vm_flags, struct page **pages)
3417{
3418 struct vm_area_struct *vma = __install_special_mapping(
3419 mm, addr, len, vm_flags, (void *)pages,
3420 &legacy_special_mapping_vmops);
3421
3422 return PTR_ERR_OR_ZERO(vma);
3423}
3424
3425static DEFINE_MUTEX(mm_all_locks_mutex);
3426
3427static void vm_lock_anon_vma(struct mm_struct *mm, struct anon_vma *anon_vma)
3428{
3429 if (!test_bit(0, (unsigned long *) &anon_vma->root->rb_root.rb_root.rb_node)) {
3430
3431
3432
3433
3434 down_write_nest_lock(&anon_vma->root->rwsem, &mm->mmap_sem);
3435
3436
3437
3438
3439
3440
3441
3442
3443
3444 if (__test_and_set_bit(0, (unsigned long *)
3445 &anon_vma->root->rb_root.rb_root.rb_node))
3446 BUG();
3447 }
3448}
3449
3450static void vm_lock_mapping(struct mm_struct *mm, struct address_space *mapping)
3451{
3452 if (!test_bit(AS_MM_ALL_LOCKS, &mapping->flags)) {
3453
3454
3455
3456
3457
3458
3459
3460
3461
3462 if (test_and_set_bit(AS_MM_ALL_LOCKS, &mapping->flags))
3463 BUG();
3464 down_write_nest_lock(&mapping->i_mmap_rwsem, &mm->mmap_sem);
3465 }
3466}
3467
3468
3469
3470
3471
3472
3473
3474
3475
3476
3477
3478
3479
3480
3481
3482
3483
3484
3485
3486
3487
3488
3489
3490
3491
3492
3493
3494
3495
3496
3497
3498
3499
3500
3501
3502
3503
3504
3505int mm_take_all_locks(struct mm_struct *mm)
3506{
3507 struct vm_area_struct *vma;
3508 struct anon_vma_chain *avc;
3509
3510 BUG_ON(down_read_trylock(&mm->mmap_sem));
3511
3512 mutex_lock(&mm_all_locks_mutex);
3513
3514 for (vma = mm->mmap; vma; vma = vma->vm_next) {
3515 if (signal_pending(current))
3516 goto out_unlock;
3517 if (vma->vm_file && vma->vm_file->f_mapping &&
3518 is_vm_hugetlb_page(vma))
3519 vm_lock_mapping(mm, vma->vm_file->f_mapping);
3520 }
3521
3522 for (vma = mm->mmap; vma; vma = vma->vm_next) {
3523 if (signal_pending(current))
3524 goto out_unlock;
3525 if (vma->vm_file && vma->vm_file->f_mapping &&
3526 !is_vm_hugetlb_page(vma))
3527 vm_lock_mapping(mm, vma->vm_file->f_mapping);
3528 }
3529
3530 for (vma = mm->mmap; vma; vma = vma->vm_next) {
3531 if (signal_pending(current))
3532 goto out_unlock;
3533 if (vma->anon_vma)
3534 list_for_each_entry(avc, &vma->anon_vma_chain, same_vma)
3535 vm_lock_anon_vma(mm, avc->anon_vma);
3536 }
3537
3538 return 0;
3539
3540out_unlock:
3541 mm_drop_all_locks(mm);
3542 return -EINTR;
3543}
3544
3545static void vm_unlock_anon_vma(struct anon_vma *anon_vma)
3546{
3547 if (test_bit(0, (unsigned long *) &anon_vma->root->rb_root.rb_root.rb_node)) {
3548
3549
3550
3551
3552
3553
3554
3555
3556
3557
3558
3559
3560 if (!__test_and_clear_bit(0, (unsigned long *)
3561 &anon_vma->root->rb_root.rb_root.rb_node))
3562 BUG();
3563 anon_vma_unlock_write(anon_vma);
3564 }
3565}
3566
3567static void vm_unlock_mapping(struct address_space *mapping)
3568{
3569 if (test_bit(AS_MM_ALL_LOCKS, &mapping->flags)) {
3570
3571
3572
3573
3574 i_mmap_unlock_write(mapping);
3575 if (!test_and_clear_bit(AS_MM_ALL_LOCKS,
3576 &mapping->flags))
3577 BUG();
3578 }
3579}
3580
3581
3582
3583
3584
3585void mm_drop_all_locks(struct mm_struct *mm)
3586{
3587 struct vm_area_struct *vma;
3588 struct anon_vma_chain *avc;
3589
3590 BUG_ON(down_read_trylock(&mm->mmap_sem));
3591 BUG_ON(!mutex_is_locked(&mm_all_locks_mutex));
3592
3593 for (vma = mm->mmap; vma; vma = vma->vm_next) {
3594 if (vma->anon_vma)
3595 list_for_each_entry(avc, &vma->anon_vma_chain, same_vma)
3596 vm_unlock_anon_vma(avc->anon_vma);
3597 if (vma->vm_file && vma->vm_file->f_mapping)
3598 vm_unlock_mapping(vma->vm_file->f_mapping);
3599 }
3600
3601 mutex_unlock(&mm_all_locks_mutex);
3602}
3603
3604
3605
3606
3607void __init mmap_init(void)
3608{
3609 int ret;
3610
3611 ret = percpu_counter_init(&vm_committed_as, 0, GFP_KERNEL);
3612 VM_BUG_ON(ret);
3613}
3614
3615
3616
3617
3618
3619
3620
3621
3622
3623
3624
3625static int init_user_reserve(void)
3626{
3627 unsigned long free_kbytes;
3628
3629 free_kbytes = global_zone_page_state(NR_FREE_PAGES) << (PAGE_SHIFT - 10);
3630
3631 sysctl_user_reserve_kbytes = min(free_kbytes / 32, 1UL << 17);
3632 return 0;
3633}
3634subsys_initcall(init_user_reserve);
3635
3636
3637
3638
3639
3640
3641
3642
3643
3644
3645
3646static int init_admin_reserve(void)
3647{
3648 unsigned long free_kbytes;
3649
3650 free_kbytes = global_zone_page_state(NR_FREE_PAGES) << (PAGE_SHIFT - 10);
3651
3652 sysctl_admin_reserve_kbytes = min(free_kbytes / 32, 1UL << 13);
3653 return 0;
3654}
3655subsys_initcall(init_admin_reserve);
3656
3657
3658
3659
3660
3661
3662
3663
3664
3665
3666
3667
3668
3669
3670
3671
3672
3673
3674
3675static int reserve_mem_notifier(struct notifier_block *nb,
3676 unsigned long action, void *data)
3677{
3678 unsigned long tmp, free_kbytes;
3679
3680 switch (action) {
3681 case MEM_ONLINE:
3682
3683 tmp = sysctl_user_reserve_kbytes;
3684 if (0 < tmp && tmp < (1UL << 17))
3685 init_user_reserve();
3686
3687
3688 tmp = sysctl_admin_reserve_kbytes;
3689 if (0 < tmp && tmp < (1UL << 13))
3690 init_admin_reserve();
3691
3692 break;
3693 case MEM_OFFLINE:
3694 free_kbytes = global_zone_page_state(NR_FREE_PAGES) << (PAGE_SHIFT - 10);
3695
3696 if (sysctl_user_reserve_kbytes > free_kbytes) {
3697 init_user_reserve();
3698 pr_info("vm.user_reserve_kbytes reset to %lu\n",
3699 sysctl_user_reserve_kbytes);
3700 }
3701
3702 if (sysctl_admin_reserve_kbytes > free_kbytes) {
3703 init_admin_reserve();
3704 pr_info("vm.admin_reserve_kbytes reset to %lu\n",
3705 sysctl_admin_reserve_kbytes);
3706 }
3707 break;
3708 default:
3709 break;
3710 }
3711 return NOTIFY_OK;
3712}
3713
3714static struct notifier_block reserve_mem_nb = {
3715 .notifier_call = reserve_mem_notifier,
3716};
3717
3718static int __meminit init_reserve_notifier(void)
3719{
3720 if (register_hotmemory_notifier(&reserve_mem_nb))
3721 pr_err("Failed registering memory add/remove notifier for admin reserve\n");
3722
3723 return 0;
3724}
3725subsys_initcall(init_reserve_notifier);
3726