1 files changed, 83 insertions, 38 deletions

diff --git a/mm/mmap.c b/mm/mmap.c
index d1e4124f3d0e..6466699b16cb 100644
--- a/mm/mmap.c
+++ b/mm/mmap.c
@@ -32,6 +32,7 @@
 #include <linux/khugepaged.h>
 #include <linux/uprobes.h>
 #include <linux/rbtree_augmented.h>
+#include <linux/sched/sysctl.h>
 
 #include <asm/uaccess.h>
 #include <asm/cacheflush.h>
@@ -143,7 +144,7 @@ int __vm_enough_memory(struct mm_struct *mm, long pages, int cap_sys_admin)
                  */
                 free -= global_page_state(NR_SHMEM);
 
-                free += nr_swap_pages;
+                free += get_nr_swap_pages();
 
                 /*
                  * Any slabs which are created with the
@@ -202,7 +203,7 @@ static void __remove_shared_vm_struct(struct vm_area_struct *vma,
                 struct file *file, struct address_space *mapping)
 {
         if (vma->vm_flags & VM_DENYWRITE)
-                atomic_inc(&file->f_path.dentry->d_inode->i_writecount);
+                atomic_inc(&file_inode(file)->i_writecount);
         if (vma->vm_flags & VM_SHARED)
                 mapping->i_mmap_writable--;
 
@@ -255,6 +256,7 @@ SYSCALL_DEFINE1(brk, unsigned long, brk)
         unsigned long newbrk, oldbrk;
         struct mm_struct *mm = current->mm;
         unsigned long min_brk;
+        bool populate;
 
         down_write(&mm->mmap_sem);
 
@@ -304,8 +306,15 @@ SYSCALL_DEFINE1(brk, unsigned long, brk)
         /* Ok, looks good - let it rip. */
         if (do_brk(oldbrk, newbrk-oldbrk) != oldbrk)
                 goto out;
+
 set_brk:
         mm->brk = brk;
+        populate = newbrk > oldbrk && (mm->def_flags & VM_LOCKED) != 0;
+        up_write(&mm->mmap_sem);
+        if (populate)
+                mm_populate(oldbrk, newbrk - oldbrk);
+        return brk;
+
 out:
         retval = mm->brk;
         up_write(&mm->mmap_sem);
@@ -567,7 +576,7 @@ static void __vma_link_file(struct vm_area_struct *vma)
                 struct address_space *mapping = file->f_mapping;
 
                 if (vma->vm_flags & VM_DENYWRITE)
-                        atomic_dec(&file->f_path.dentry->d_inode->i_writecount);
+                        atomic_dec(&file_inode(file)->i_writecount);
                 if (vma->vm_flags & VM_SHARED)
                         mapping->i_mmap_writable++;
 
@@ -800,7 +809,7 @@ again:			remove_next = 1 + (end > next->vm_end);
                 anon_vma_interval_tree_post_update_vma(vma);
                 if (adjust_next)
                         anon_vma_interval_tree_post_update_vma(next);
-                anon_vma_unlock(anon_vma);
+                anon_vma_unlock_write(anon_vma);
         }
         if (mapping)
                 mutex_unlock(&mapping->i_mmap_mutex);
@@ -1153,12 +1162,15 @@ static inline unsigned long round_hint_to_min(unsigned long hint)
 
 unsigned long do_mmap_pgoff(struct file *file, unsigned long addr,
                         unsigned long len, unsigned long prot,
-                        unsigned long flags, unsigned long pgoff)
+                        unsigned long flags, unsigned long pgoff,
+                        unsigned long *populate)
 {
         struct mm_struct * mm = current->mm;
         struct inode *inode;
         vm_flags_t vm_flags;
 
+        *populate = 0;
+
         /*
          * Does the application expect PROT_READ to imply PROT_EXEC?
          *
@@ -1217,7 +1229,7 @@ unsigned long do_mmap_pgoff(struct file *file, unsigned long addr,
                         return -EAGAIN;
         }
 
-        inode = file ? file->f_path.dentry->d_inode : NULL;
+        inode = file ? file_inode(file) : NULL;
 
         if (file) {
                 switch (flags & MAP_TYPE) {
@@ -1279,7 +1291,26 @@ unsigned long do_mmap_pgoff(struct file *file, unsigned long addr,
                 }
         }
 
-        return mmap_region(file, addr, len, flags, vm_flags, pgoff);
+        /*
+         * Set 'VM_NORESERVE' if we should not account for the
+         * memory use of this mapping.
+         */
+        if (flags & MAP_NORESERVE) {
+                /* We honor MAP_NORESERVE if allowed to overcommit */
+                if (sysctl_overcommit_memory != OVERCOMMIT_NEVER)
+                        vm_flags |= VM_NORESERVE;
+
+                /* hugetlb applies strict overcommit unless MAP_NORESERVE */
+                if (file && is_file_hugepages(file))
+                        vm_flags |= VM_NORESERVE;
+        }
+
+        addr = mmap_region(file, addr, len, vm_flags, pgoff);
+        if (!IS_ERR_VALUE(addr) &&
+            ((vm_flags & VM_LOCKED) ||
+             (flags & (MAP_POPULATE | MAP_NONBLOCK)) == MAP_POPULATE))
+                *populate = len;
+        return addr;
 }
 
 SYSCALL_DEFINE6(mmap_pgoff, unsigned long, addr, unsigned long, len,
@@ -1394,8 +1425,7 @@ static inline int accountable_mapping(struct file *file, vm_flags_t vm_flags)
 }
 
 unsigned long mmap_region(struct file *file, unsigned long addr,
-                          unsigned long len, unsigned long flags,
-                          vm_flags_t vm_flags, unsigned long pgoff)
+                unsigned long len, vm_flags_t vm_flags, unsigned long pgoff)
 {
         struct mm_struct *mm = current->mm;
         struct vm_area_struct *vma, *prev;
@@ -1403,7 +1433,7 @@ unsigned long mmap_region(struct file *file, unsigned long addr,
         int error;
         struct rb_node **rb_link, *rb_parent;
         unsigned long charged = 0;
-        struct inode *inode =  file ? file->f_path.dentry->d_inode : NULL;
+        struct inode *inode =  file ? file_inode(file) : NULL;
 
         /* Clear old maps */
         error = -ENOMEM;
@@ -1419,20 +1449,6 @@ munmap_back:
                 return -ENOMEM;
 
         /*
-         * Set 'VM_NORESERVE' if we should not account for the
-         * memory use of this mapping.
-         */
-        if ((flags & MAP_NORESERVE)) {
-                /* We honor MAP_NORESERVE if allowed to overcommit */
-                if (sysctl_overcommit_memory != OVERCOMMIT_NEVER)
-                        vm_flags |= VM_NORESERVE;
-
-                /* hugetlb applies strict overcommit unless MAP_NORESERVE */
-                if (file && is_file_hugepages(file))
-                        vm_flags |= VM_NORESERVE;
-        }
-
-        /*
          * Private writable mapping: check memory availability
          */
         if (accountable_mapping(file, vm_flags)) {
@@ -1530,10 +1546,12 @@ out:
 
         vm_stat_account(mm, vm_flags, file, len >> PAGE_SHIFT);
         if (vm_flags & VM_LOCKED) {
-                if (!mlock_vma_pages_range(vma, addr, addr + len))
+                if (!((vm_flags & VM_SPECIAL) || is_vm_hugetlb_page(vma) ||
+                                        vma == get_gate_vma(current->mm)))
                         mm->locked_vm += (len >> PAGE_SHIFT);
-        } else if ((flags & MAP_POPULATE) && !(flags & MAP_NONBLOCK))
-                make_pages_present(addr, addr + len);
+                else
+                        vma->vm_flags &= ~VM_LOCKED;
+        }
 
         if (file)
                 uprobe_mmap(vma);
@@ -2169,9 +2187,28 @@ int expand_downwards(struct vm_area_struct *vma,
         return error;
 }
 
+/*
+ * Note how expand_stack() refuses to expand the stack all the way to
+ * abut the next virtual mapping, *unless* that mapping itself is also
+ * a stack mapping. We want to leave room for a guard page, after all
+ * (the guard page itself is not added here, that is done by the
+ * actual page faulting logic)
+ *
+ * This matches the behavior of the guard page logic (see mm/memory.c:
+ * check_stack_guard_page()), which only allows the guard page to be
+ * removed under these circumstances.
+ */
 #ifdef CONFIG_STACK_GROWSUP
 int expand_stack(struct vm_area_struct *vma, unsigned long address)
 {
+        struct vm_area_struct *next;
+
+        address &= PAGE_MASK;
+        next = vma->vm_next;
+        if (next && next->vm_start == address + PAGE_SIZE) {
+                if (!(next->vm_flags & VM_GROWSUP))
+                        return -ENOMEM;
+        }
         return expand_upwards(vma, address);
 }
 
@@ -2186,14 +2223,21 @@ find_extend_vma(struct mm_struct *mm, unsigned long addr)
                 return vma;
         if (!prev || expand_stack(prev, addr))
                 return NULL;
-        if (prev->vm_flags & VM_LOCKED) {
-                mlock_vma_pages_range(prev, addr, prev->vm_end);
-        }
+        if (prev->vm_flags & VM_LOCKED)
+                __mlock_vma_pages_range(prev, addr, prev->vm_end, NULL);
         return prev;
 }
 #else
 int expand_stack(struct vm_area_struct *vma, unsigned long address)
 {
+        struct vm_area_struct *prev;
+
+        address &= PAGE_MASK;
+        prev = vma->vm_prev;
+        if (prev && prev->vm_end == address) {
+                if (!(prev->vm_flags & VM_GROWSDOWN))
+                        return -ENOMEM;
+        }
         return expand_downwards(vma, address);
 }
 
@@ -2214,9 +2258,8 @@ find_extend_vma(struct mm_struct * mm, unsigned long addr)
         start = vma->vm_start;
         if (expand_stack(vma, addr))
                 return NULL;
-        if (vma->vm_flags & VM_LOCKED) {
-                mlock_vma_pages_range(vma, addr, start);
-        }
+        if (vma->vm_flags & VM_LOCKED)
+                __mlock_vma_pages_range(vma, addr, start, NULL);
         return vma;
 }
 #endif
@@ -2589,10 +2632,8 @@ static unsigned long do_brk(unsigned long addr, unsigned long len)
 out:
         perf_event_mmap(vma);
         mm->total_vm += len >> PAGE_SHIFT;
-        if (flags & VM_LOCKED) {
-                if (!mlock_vma_pages_range(vma, addr, addr + len))
-                        mm->locked_vm += (len >> PAGE_SHIFT);
-        }
+        if (flags & VM_LOCKED)
+                mm->locked_vm += (len >> PAGE_SHIFT);
         return addr;
 }
 
@@ -2600,10 +2641,14 @@ unsigned long vm_brk(unsigned long addr, unsigned long len)
 {
         struct mm_struct *mm = current->mm;
         unsigned long ret;
+        bool populate;
 
         down_write(&mm->mmap_sem);
         ret = do_brk(addr, len);
+        populate = ((mm->def_flags & VM_LOCKED) != 0);
         up_write(&mm->mmap_sem);
+        if (populate)
+                mm_populate(addr, len);
         return ret;
 }
 EXPORT_SYMBOL(vm_brk);
@@ -3001,7 +3046,7 @@ static void vm_unlock_anon_vma(struct anon_vma *anon_vma)
                 if (!__test_and_clear_bit(0, (unsigned long *)
                                           &anon_vma->root->rb_root.rb_node))
                         BUG();
-                anon_vma_unlock(anon_vma);
+                anon_vma_unlock_write(anon_vma);
         }
 }