1 files changed, 19 insertions, 27 deletions

diff --git a/fs/hugetlbfs/inode.c b/fs/hugetlbfs/inode.c
index 4ee3f006b861..7f4756963d05 100644
--- a/fs/hugetlbfs/inode.c
+++ b/fs/hugetlbfs/inode.c
@@ -62,24 +62,19 @@ static int hugetlbfs_file_mmap(struct file *file, struct vm_area_struct *vma)
         loff_t len, vma_len;
         int ret;
 
-        if (vma->vm_pgoff & (HPAGE_SIZE / PAGE_SIZE - 1))
-                return -EINVAL;
-
-        if (vma->vm_start & ~HPAGE_MASK)
-                return -EINVAL;
-
-        if (vma->vm_end & ~HPAGE_MASK)
-                return -EINVAL;
-
-        if (vma->vm_end - vma->vm_start < HPAGE_SIZE)
-                return -EINVAL;
+        /*
+         * vma alignment has already been checked by prepare_hugepage_range.
+         * If you add any error returns here, do so after setting VM_HUGETLB,
+         * so is_vm_hugetlb_page tests below unmap_region go the right way
+         * when do_mmap_pgoff unwinds (may be important on powerpc and ia64).
+         */
+        vma->vm_flags |= VM_HUGETLB | VM_RESERVED;
+        vma->vm_ops = &hugetlb_vm_ops;
 
         vma_len = (loff_t)(vma->vm_end - vma->vm_start);
 
         mutex_lock(&inode->i_mutex);
         file_accessed(file);
-        vma->vm_flags |= VM_HUGETLB | VM_RESERVED;
-        vma->vm_ops = &hugetlb_vm_ops;
 
         ret = -ENOMEM;
         len = vma_len + ((loff_t)vma->vm_pgoff << PAGE_SHIFT);
@@ -271,26 +266,24 @@ static void hugetlbfs_drop_inode(struct inode *inode)
                 hugetlbfs_forget_inode(inode);
 }
 
-/*
- * h_pgoff is in HPAGE_SIZE units.
- * vma->vm_pgoff is in PAGE_SIZE units.
- */
 static inline void
-hugetlb_vmtruncate_list(struct prio_tree_root *root, unsigned long h_pgoff)
+hugetlb_vmtruncate_list(struct prio_tree_root *root, pgoff_t pgoff)
 {
         struct vm_area_struct *vma;
         struct prio_tree_iter iter;
 
-        vma_prio_tree_foreach(vma, &iter, root, h_pgoff, ULONG_MAX) {
-                unsigned long h_vm_pgoff;
+        vma_prio_tree_foreach(vma, &iter, root, pgoff, ULONG_MAX) {
                 unsigned long v_offset;
 
-                h_vm_pgoff = vma->vm_pgoff >> (HPAGE_SHIFT - PAGE_SHIFT);
-                v_offset = (h_pgoff - h_vm_pgoff) << HPAGE_SHIFT;
                 /*
-                 * Is this VMA fully outside the truncation point?
+                 * Can the expression below overflow on 32-bit arches?
+                 * No, because the prio_tree returns us only those vmas
+                 * which overlap the truncated area starting at pgoff,
+                 * and no vma on a 32-bit arch can span beyond the 4GB.
                  */
-                if (h_vm_pgoff >= h_pgoff)
+                if (vma->vm_pgoff < pgoff)
+                        v_offset = (pgoff - vma->vm_pgoff) << PAGE_SHIFT;
+                else
                         v_offset = 0;
 
                 __unmap_hugepage_range(vma,
@@ -303,14 +296,14 @@ hugetlb_vmtruncate_list(struct prio_tree_root *root, unsigned long h_pgoff)
  */
 static int hugetlb_vmtruncate(struct inode *inode, loff_t offset)
 {
-        unsigned long pgoff;
+        pgoff_t pgoff;
         struct address_space *mapping = inode->i_mapping;
 
         if (offset > inode->i_size)
                 return -EINVAL;
 
         BUG_ON(offset & ~HPAGE_MASK);
-        pgoff = offset >> HPAGE_SHIFT;
+        pgoff = offset >> PAGE_SHIFT;
 
         inode->i_size = offset;
         spin_lock(&mapping->i_mmap_lock);
@@ -624,7 +617,6 @@ hugetlbfs_parse_options(char *options, struct hugetlbfs_config *pconfig)
                                 do_div(size, 100);
                                 rest++;
                         }
-                        size &= HPAGE_MASK;
                         pconfig->nr_blocks = (size >> HPAGE_SHIFT);
                         value = rest;
                 } else if (!strcmp(opt,"nr_inodes")) {