1 files changed, 36 insertions, 75 deletions

diff --git a/mm/hugetlb.c b/mm/hugetlb.c
index 85855240933d..bb0b7c128015 100644
--- a/mm/hugetlb.c
+++ b/mm/hugetlb.c
@@ -394,71 +394,6 @@ static int vma_has_reserves(struct vm_area_struct *vma)
         return 0;
 }
 
-static void clear_gigantic_page(struct page *page,
-                        unsigned long addr, unsigned long sz)
-{
-        int i;
-        struct page *p = page;
-
-        might_sleep();
-        for (i = 0; i < sz/PAGE_SIZE; i++, p = mem_map_next(p, page, i)) {
-                cond_resched();
-                clear_user_highpage(p, addr + i * PAGE_SIZE);
-        }
-}
-static void clear_huge_page(struct page *page,
-                        unsigned long addr, unsigned long sz)
-{
-        int i;
-
-        if (unlikely(sz/PAGE_SIZE > MAX_ORDER_NR_PAGES)) {
-                clear_gigantic_page(page, addr, sz);
-                return;
-        }
-
-        might_sleep();
-        for (i = 0; i < sz/PAGE_SIZE; i++) {
-                cond_resched();
-                clear_user_highpage(page + i, addr + i * PAGE_SIZE);
-        }
-}
-
-static void copy_user_gigantic_page(struct page *dst, struct page *src,
-                           unsigned long addr, struct vm_area_struct *vma)
-{
-        int i;
-        struct hstate *h = hstate_vma(vma);
-        struct page *dst_base = dst;
-        struct page *src_base = src;
-
-        for (i = 0; i < pages_per_huge_page(h); ) {
-                cond_resched();
-                copy_user_highpage(dst, src, addr + i*PAGE_SIZE, vma);
-
-                i++;
-                dst = mem_map_next(dst, dst_base, i);
-                src = mem_map_next(src, src_base, i);
-        }
-}
-
-static void copy_user_huge_page(struct page *dst, struct page *src,
-                           unsigned long addr, struct vm_area_struct *vma)
-{
-        int i;
-        struct hstate *h = hstate_vma(vma);
-
-        if (unlikely(pages_per_huge_page(h) > MAX_ORDER_NR_PAGES)) {
-                copy_user_gigantic_page(dst, src, addr, vma);
-                return;
-        }
-
-        might_sleep();
-        for (i = 0; i < pages_per_huge_page(h); i++) {
-                cond_resched();
-                copy_user_highpage(dst + i, src + i, addr + i*PAGE_SIZE, vma);
-        }
-}
-
 static void copy_gigantic_page(struct page *dst, struct page *src)
 {
         int i;
@@ -1428,6 +1363,7 @@ static ssize_t nr_hugepages_show_common(struct kobject *kobj,
 
         return sprintf(buf, "%lu\n", nr_huge_pages);
 }
+
 static ssize_t nr_hugepages_store_common(bool obey_mempolicy,
                         struct kobject *kobj, struct kobj_attribute *attr,
                         const char *buf, size_t len)
@@ -1440,9 +1376,14 @@ static ssize_t nr_hugepages_store_common(bool obey_mempolicy,
 
         err = strict_strtoul(buf, 10, &count);
         if (err)
-                return 0;
+                goto out;
 
         h = kobj_to_hstate(kobj, &nid);
+        if (h->order >= MAX_ORDER) {
+                err = -EINVAL;
+                goto out;
+        }
+
         if (nid == NUMA_NO_NODE) {
                 /*
                  * global hstate attribute
@@ -1468,6 +1409,9 @@ static ssize_t nr_hugepages_store_common(bool obey_mempolicy,
                 NODEMASK_FREE(nodes_allowed);
 
         return len;
+out:
+        NODEMASK_FREE(nodes_allowed);
+        return err;
 }
 
 static ssize_t nr_hugepages_show(struct kobject *kobj,
@@ -1510,6 +1454,7 @@ static ssize_t nr_overcommit_hugepages_show(struct kobject *kobj,
         struct hstate *h = kobj_to_hstate(kobj, NULL);
         return sprintf(buf, "%lu\n", h->nr_overcommit_huge_pages);
 }
+
 static ssize_t nr_overcommit_hugepages_store(struct kobject *kobj,
                 struct kobj_attribute *attr, const char *buf, size_t count)
 {
@@ -1517,9 +1462,12 @@ static ssize_t nr_overcommit_hugepages_store(struct kobject *kobj,
         unsigned long input;
         struct hstate *h = kobj_to_hstate(kobj, NULL);
 
+        if (h->order >= MAX_ORDER)
+                return -EINVAL;
+
         err = strict_strtoul(buf, 10, &input);
         if (err)
-                return 0;
+                return err;
 
         spin_lock(&hugetlb_lock);
         h->nr_overcommit_huge_pages = input;
@@ -1922,13 +1870,19 @@ static int hugetlb_sysctl_handler_common(bool obey_mempolicy,
 {
         struct hstate *h = &default_hstate;
         unsigned long tmp;
+        int ret;
 
         if (!write)
                 tmp = h->max_huge_pages;
 
+        if (write && h->order >= MAX_ORDER)
+                return -EINVAL;
+
         table->data = &tmp;
         table->maxlen = sizeof(unsigned long);
-        proc_doulongvec_minmax(table, write, buffer, length, ppos);
+        ret = proc_doulongvec_minmax(table, write, buffer, length, ppos);
+        if (ret)
+                goto out;
 
         if (write) {
                 NODEMASK_ALLOC(nodemask_t, nodes_allowed,
@@ -1943,8 +1897,8 @@ static int hugetlb_sysctl_handler_common(bool obey_mempolicy,
                 if (nodes_allowed != &node_states[N_HIGH_MEMORY])
                         NODEMASK_FREE(nodes_allowed);
         }
-
-        return 0;
+out:
+        return ret;
 }
 
 int hugetlb_sysctl_handler(struct ctl_table *table, int write,
@@ -1982,21 +1936,27 @@ int hugetlb_overcommit_handler(struct ctl_table *table, int write,
 {
         struct hstate *h = &default_hstate;
         unsigned long tmp;
+        int ret;
 
         if (!write)
                 tmp = h->nr_overcommit_huge_pages;
 
+        if (write && h->order >= MAX_ORDER)
+                return -EINVAL;
+
         table->data = &tmp;
         table->maxlen = sizeof(unsigned long);
-        proc_doulongvec_minmax(table, write, buffer, length, ppos);
+        ret = proc_doulongvec_minmax(table, write, buffer, length, ppos);
+        if (ret)
+                goto out;
 
         if (write) {
                 spin_lock(&hugetlb_lock);
                 h->nr_overcommit_huge_pages = tmp;
                 spin_unlock(&hugetlb_lock);
         }
-
-        return 0;
+out:
+        return ret;
 }
 
 #endif /* CONFIG_SYSCTL */
@@ -2454,7 +2414,8 @@ retry_avoidcopy:
                 return VM_FAULT_OOM;
         }
 
-        copy_user_huge_page(new_page, old_page, address, vma);
+        copy_user_huge_page(new_page, old_page, address, vma,
+                            pages_per_huge_page(h));
         __SetPageUptodate(new_page);
 
         /*
@@ -2558,7 +2519,7 @@ retry:
                         ret = -PTR_ERR(page);
                         goto out;
                 }
-                clear_huge_page(page, address, huge_page_size(h));
+                clear_huge_page(page, address, pages_per_huge_page(h));
                 __SetPageUptodate(page);
 
                 if (vma->vm_flags & VM_MAYSHARE) {