Hugh Dickins 1f2284fac2 mm: fix new crash in unmapped_area_topdown() ...

commit f4cb767d76 upstream.

Trinity gets kernel BUG at mm/mmap.c:1963! in about 3 minutes of
mmap testing.  That's the VM_BUG_ON(gap_end < gap_start) at the
end of unmapped_area_topdown().  Linus points out how MAP_FIXED
(which does not have to respect our stack guard gap intentions)
could result in gap_end below gap_start there.  Fix that, and
the similar case in its alternative, unmapped_area().

Fixes: 1be7107fbe ("mm: larger stack guard gap, between vmas")
Reported-by: Dave Jones <davej@codemonkey.org.uk>
Debugged-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Hugh Dickins <hughd@google.com>
Acked-by: Michal Hocko <mhocko@suse.com>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

2017-06-26 07:13:11 +02:00

..

kasan

kasan: respect /proc/sys/kernel/traceoff_on_warning

2017-06-17 06:39:36 +02:00

backing-dev.c

block: fix double-free in the failure path of cgwb_bdi_init()

2017-02-26 11:07:51 +01:00

balloon_compaction.c

virtio_balloon: fix race between migration and ballooning

2016-03-03 15:07:18 -08:00

bootmem.c

…

cleancache.c

…

cma_debug.c

…

cma.c

mm/cma: silence warnings due to max() usage

2016-11-10 16:36:36 +01:00

cma.h

…

compaction.c

mm, compaction: prevent VM_BUG_ON when terminating freeing scanner

2016-08-10 11:49:25 +02:00

debug-pagealloc.c

…

debug.c

mm: make compound_head() robust

2015-11-06 17:50:42 -08:00

dmapool.c

mm, page_alloc: distinguish between being unable to sleep, unwilling to sleep and avoiding waking kswapd

2015-11-06 17:50:42 -08:00

early_ioremap.c

mm/early_ioremap: use offset_in_page macro

2015-11-05 19:34:48 -08:00

fadvise.c

…

failslab.c

mm, page_alloc: rename __GFP_WAIT to __GFP_RECLAIM

2015-11-06 17:50:42 -08:00

filemap.c

mm: do not access page->mapping directly on page_endio

2017-03-12 06:37:25 +01:00

frame_vector.c

mm: fix docbook comment for get_vaddr_frames()

2015-11-05 19:34:48 -08:00

frontswap.c

…

gup.c

mm: larger stack guard gap, between vmas

2017-06-26 07:13:11 +02:00

highmem.c

…

huge_memory.c

mm/huge_memory.c: respect FOLL_FORCE/FOLL_COW for thp

2017-05-25 14:30:16 +02:00

hugetlb_cgroup.c

mm: make compound_head() robust

2015-11-06 17:50:42 -08:00

hugetlb.c

mm, hugetlb: use pte_present() instead of pmd_present() in follow_huge_pmd()

2017-04-08 09:53:32 +02:00

hwpoison-inject.c

…

init-mm.c

mm: Add a user_ns owner to mm_struct and fix ptrace permission checks

2017-01-06 11:16:11 +01:00

internal.h

mm, sl[au]b: add __GFP_ATOMIC to the GFP reclaim mask

2016-08-10 11:49:25 +02:00

interval_tree.c

…

Kconfig

mm: make compound_head() robust

2015-11-06 17:50:42 -08:00

Kconfig.debug

…

kmemcheck.c

…

kmemleak-test.c

…

kmemleak.c

mm/kmemleak.c: remove unneeded initialization of object to NULL

2015-11-05 19:34:48 -08:00

ksm.c

mm,ksm: fix endless looping in allocating memory when ksm enable

2016-10-07 15:23:40 +02:00

list_lru.c

mm/list_lru.c: avoid error-path NULL pointer deref

2016-11-10 16:36:32 +01:00

maccess.c

mm/maccess.c: actually return -EFAULT from strncpy_from_unsafe

2015-11-05 19:34:48 -08:00

madvise.c

…

Makefile

…

memblock.c

mm: consider memblock reservations for deferred memory initialization sizing

2017-06-14 13:16:26 +02:00

memcontrol.c

mm: memcontrol: avoid unused function warning

2017-03-18 19:09:57 +08:00

memory_hotplug.c

base/memory, hotplug: fix a kernel oops in show_valid_zones()

2017-02-09 08:02:47 +01:00

memory-failure.c

mm/memory-failure.c: use compound_head() flags for huge pages

2017-06-26 07:13:10 +02:00

memory.c

mm: larger stack guard gap, between vmas

2017-06-26 07:13:11 +02:00

mempolicy.c

mm/mempolicy.c: fix error handling in set_mempolicy and mbind.

2017-04-12 12:38:35 +02:00

mempool.c

mm, page_alloc: distinguish between being unable to sleep, unwilling to sleep and avoiding waking kswapd

2015-11-06 17:50:42 -08:00

memtest.c

…

migrate.c

mm: Export migrate_page_move_mapping and migrate_page_copy

2016-07-27 09:47:31 -07:00

mincore.c

mm/mincore: use offset_in_page macro

2015-11-05 19:34:48 -08:00

mlock.c

mlock: fix mlock count can not decrease in race condition

2017-06-07 12:06:01 +02:00

mm_init.c

…

mmap.c

mm: fix new crash in unmapped_area_topdown()

2017-06-26 07:13:11 +02:00

mmu_context.c

…

mmu_notifier.c

…

mmzone.c

…

mprotect.c

…

mremap.c

mm/mremap: use offset_in_page macro

2015-11-05 19:34:48 -08:00

msync.c

mm/msync: use offset_in_page macro

2015-11-05 19:34:48 -08:00

nobootmem.c

…

nommu.c

mm/nommu.c: drop unlikely inside BUG_ON()

2015-11-05 19:34:48 -08:00

oom_kill.c

mm/oom_kill.c: avoid attempting to kill init sharing same memory

2015-12-12 10:15:34 -08:00

page_alloc.c

mm: consider memblock reservations for deferred memory initialization sizing

2017-06-14 13:16:26 +02:00

page_counter.c

mm: page_counter: let page_counter_try_charge() return bool

2015-11-05 19:34:48 -08:00

page_ext.c

…

page_idle.c

…

page_io.c

…

page_isolation.c

mm: fix invalid node in alloc_migrate_target()

2016-04-20 15:41:53 +09:00

page_owner.c

…

page-writeback.c

writeback: use higher precision calculation in domain_dirty_limits()

2016-07-27 09:47:29 -07:00

pagewalk.c

…

percpu-km.c

…

percpu-vm.c

…

percpu.c

percpu: acquire pcpu_lock when updating pcpu_nr_empty_pop_pages

2017-03-26 12:13:20 +02:00

pgtable-generic.c

mm,thp: khugepaged: call pte flush at the time of collapse

2016-02-25 12:01:23 -08:00

process_vm_access.c

ptrace: use fsuid, fsgid, effective creds for fs access checks

2016-02-25 12:01:16 -08:00

quicklist.c

…

readahead.c

mm, fs: introduce mapping_gfp_constraint()

2015-11-06 17:50:42 -08:00

rmap.c

mm: page migration use migration entry for swapcache too

2015-11-05 19:34:48 -08:00

shmem.c

tmpfs: fix regression hang in fallocate undo

2016-07-27 09:47:40 -07:00

slab_common.c

mm: memcontrol: fix cgroup creation failure after many small jobs

2016-08-16 09:30:51 +02:00

slab.c

slab/slub: adjust kmem_cache_alloc_bulk API

2015-11-22 11:58:44 -08:00

slab.h

slab/slub: adjust kmem_cache_alloc_bulk API

2015-11-22 11:58:44 -08:00

slob.c

slab/slub: adjust kmem_cache_alloc_bulk API

2015-11-22 11:58:44 -08:00

slub.c

slub/memcg: cure the brainless abuse of sysfs attributes

2017-06-07 12:06:01 +02:00

sparse-vmemmap.c

…

sparse.c

…

swap_cgroup.c

swap: cond_resched in swap_cgroup_prepare()

2017-06-26 07:13:10 +02:00

swap_state.c

…

swap.c

mm: make compound_head() robust

2015-11-06 17:50:42 -08:00

swapfile.c

swapfile: fix memory corruption via malformed swapfile

2016-11-18 10:48:34 +01:00

truncate.c

fs: add i_blocksize()

2017-06-14 13:16:24 +02:00

userfaultfd.c

…

util.c

proc: revert /proc/<pid>/maps [stack:TID] annotation

2016-09-15 08:27:46 +02:00

vmacache.c

mm/vmacache: inline vmacache_valid_mm()

2015-11-05 19:34:48 -08:00

vmalloc.c

mm: vmalloc: don't remove inexistent guard hole in remove_vm_area()

2015-11-20 16:17:32 -08:00

vmpressure.c

mm: vmpressure: fix sending wrong events on underflow

2017-03-12 06:37:25 +01:00

vmscan.c

mm/vmscan.c: set correct defer count for shrinker

2017-01-06 11:16:14 +01:00

vmstat.c

vmstat: allocate vmstat_wq before it is used

2016-01-08 23:47:54 -08:00

workingset.c

mm: workingset: fix crash in shadow node shrinker caused by replace_page_cache_page()

2016-10-28 03:01:34 -04:00

zbud.c

mm: zsmalloc: constify struct zs_pool name

2015-11-06 17:50:42 -08:00

zpool.c

mm: zsmalloc: constify struct zs_pool name

2015-11-06 17:50:42 -08:00

zsmalloc.c

zsmalloc: fix zs_can_compact() integer overflow

2016-05-18 17:06:44 -07:00

zswap.c

zswap: disable changing params if init fails

2017-02-09 08:02:45 +01:00