1 files changed, 24 insertions, 16 deletions

diff --git a/fs/hugetlbfs/inode.c b/fs/hugetlbfs/inode.c
index 8f96461236f6..dde861387a40 100644
--- a/fs/hugetlbfs/inode.c
+++ b/fs/hugetlbfs/inode.c
@@ -136,17 +136,26 @@ static int hugetlbfs_file_mmap(struct file *file, struct vm_area_struct *vma)
         vma->vm_flags |= VM_HUGETLB | VM_DONTEXPAND;
         vma->vm_ops = &hugetlb_vm_ops;
 
+        /*
+         * Offset passed to mmap (before page shift) could have been
+         * negative when represented as a (l)off_t.
+         */
+        if (((loff_t)vma->vm_pgoff << PAGE_SHIFT) < 0)
+                return -EINVAL;
+
         if (vma->vm_pgoff & (~huge_page_mask(h) >> PAGE_SHIFT))
                 return -EINVAL;
 
         vma_len = (loff_t)(vma->vm_end - vma->vm_start);
+        len = vma_len + ((loff_t)vma->vm_pgoff << PAGE_SHIFT);
+        /* check for overflow */
+        if (len < vma_len)
+                return -EINVAL;
 
         inode_lock(inode);
         file_accessed(file);
 
         ret = -ENOMEM;
-        len = vma_len + ((loff_t)vma->vm_pgoff << PAGE_SHIFT);
-
         if (hugetlb_reserve_pages(inode,
                                 vma->vm_pgoff >> huge_page_order(h),
                                 len >> huge_page_shift(h), vma,
@@ -155,7 +164,7 @@ static int hugetlbfs_file_mmap(struct file *file, struct vm_area_struct *vma)
 
         ret = 0;
         if (vma->vm_flags & VM_WRITE && inode->i_size < len)
-                inode->i_size = len;
+                i_size_write(inode, len);
 out:
         inode_unlock(inode);
 
@@ -695,14 +704,11 @@ static struct inode *hugetlbfs_get_root(struct super_block *sb,
 
         inode = new_inode(sb);
         if (inode) {
-                struct hugetlbfs_inode_info *info;
                 inode->i_ino = get_next_ino();
                 inode->i_mode = S_IFDIR | config->mode;
                 inode->i_uid = config->uid;
                 inode->i_gid = config->gid;
                 inode->i_atime = inode->i_mtime = inode->i_ctime = current_time(inode);
-                info = HUGETLBFS_I(inode);
-                mpol_shared_policy_init(&info->policy, NULL);
                 inode->i_op = &hugetlbfs_dir_inode_operations;
                 inode->i_fop = &simple_dir_operations;
                 /* directory inodes start off with i_nlink == 2 (for "." entry) */
@@ -733,7 +739,6 @@ static struct inode *hugetlbfs_get_inode(struct super_block *sb,
 
         inode = new_inode(sb);
         if (inode) {
-                struct hugetlbfs_inode_info *info;
                 inode->i_ino = get_next_ino();
                 inode_init_owner(inode, dir, mode);
                 lockdep_set_class(&inode->i_mapping->i_mmap_rwsem,
@@ -741,15 +746,6 @@ static struct inode *hugetlbfs_get_inode(struct super_block *sb,
                 inode->i_mapping->a_ops = &hugetlbfs_aops;
                 inode->i_atime = inode->i_mtime = inode->i_ctime = current_time(inode);
                 inode->i_mapping->private_data = resv_map;
-                info = HUGETLBFS_I(inode);
-                /*
-                 * The policy is initialized here even if we are creating a
-                 * private inode because initialization simply creates an
-                 * an empty rb tree and calls rwlock_init(), later when we
-                 * call mpol_free_shared_policy() it will just return because
-                 * the rb tree will still be empty.
-                 */
-                mpol_shared_policy_init(&info->policy, NULL);
                 switch (mode & S_IFMT) {
                 default:
                         init_special_inode(inode, mode, dev);
@@ -937,6 +933,18 @@ static struct inode *hugetlbfs_alloc_inode(struct super_block *sb)
                 hugetlbfs_inc_free_inodes(sbinfo);
                 return NULL;
         }
+
+        /*
+         * Any time after allocation, hugetlbfs_destroy_inode can be called
+         * for the inode.  mpol_free_shared_policy is unconditionally called
+         * as part of hugetlbfs_destroy_inode.  So, initialize policy here
+         * in case of a quick call to destroy.
+         *
+         * Note that the policy is initialized even if we are creating a
+         * private inode.  This simplifies hugetlbfs_destroy_inode.
+         */
+        mpol_shared_policy_init(&p->policy, NULL);
+
         return &p->vfs_inode;
 }