1 files changed, 19 insertions, 12 deletions

diff --git a/mm/mremap.c b/mm/mremap.c
index cde56ee51ef7..506fa44403df 100644
--- a/mm/mremap.c
+++ b/mm/mremap.c
@@ -41,13 +41,15 @@ static pmd_t *get_old_pmd(struct mm_struct *mm, unsigned long addr)
                 return NULL;
 
         pmd = pmd_offset(pud, addr);
+        split_huge_page_pmd(mm, pmd);
         if (pmd_none_or_clear_bad(pmd))
                 return NULL;
 
         return pmd;
 }
 
-static pmd_t *alloc_new_pmd(struct mm_struct *mm, unsigned long addr)
+static pmd_t *alloc_new_pmd(struct mm_struct *mm, struct vm_area_struct *vma,
+                            unsigned long addr)
 {
         pgd_t *pgd;
         pud_t *pud;
@@ -62,7 +64,8 @@ static pmd_t *alloc_new_pmd(struct mm_struct *mm, unsigned long addr)
         if (!pmd)
                 return NULL;
 
-        if (!pmd_present(*pmd) && __pte_alloc(mm, pmd, addr))
+        VM_BUG_ON(pmd_trans_huge(*pmd));
+        if (pmd_none(*pmd) && __pte_alloc(mm, vma, pmd, addr))
                 return NULL;
 
         return pmd;
@@ -90,10 +93,7 @@ static void move_ptes(struct vm_area_struct *vma, pmd_t *old_pmd,
                  * and we propagate stale pages into the dst afterward.
                  */
                 mapping = vma->vm_file->f_mapping;
-                spin_lock(&mapping->i_mmap_lock);
-                if (new_vma->vm_truncate_count &&
-                    new_vma->vm_truncate_count != vma->vm_truncate_count)
-                        new_vma->vm_truncate_count = 0;
+                mutex_lock(&mapping->i_mmap_mutex);
         }
 
         /*
@@ -101,7 +101,7 @@ static void move_ptes(struct vm_area_struct *vma, pmd_t *old_pmd,
          * pte locks because exclusive mmap_sem prevents deadlock.
          */
         old_pte = pte_offset_map_lock(mm, old_pmd, old_addr, &old_ptl);
-        new_pte = pte_offset_map_nested(new_pmd, new_addr);
+        new_pte = pte_offset_map(new_pmd, new_addr);
         new_ptl = pte_lockptr(mm, new_pmd);
         if (new_ptl != old_ptl)
                 spin_lock_nested(new_ptl, SINGLE_DEPTH_NESTING);
@@ -119,10 +119,10 @@ static void move_ptes(struct vm_area_struct *vma, pmd_t *old_pmd,
         arch_leave_lazy_mmu_mode();
         if (new_ptl != old_ptl)
                 spin_unlock(new_ptl);
-        pte_unmap_nested(new_pte - 1);
+        pte_unmap(new_pte - 1);
         pte_unmap_unlock(old_pte - 1, old_ptl);
         if (mapping)
-                spin_unlock(&mapping->i_mmap_lock);
+                mutex_unlock(&mapping->i_mmap_mutex);
         mmu_notifier_invalidate_range_end(vma->vm_mm, old_start, old_end);
 }
 
@@ -147,7 +147,7 @@ unsigned long move_page_tables(struct vm_area_struct *vma,
                 old_pmd = get_old_pmd(vma->vm_mm, old_addr);
                 if (!old_pmd)
                         continue;
-                new_pmd = alloc_new_pmd(vma->vm_mm, new_addr);
+                new_pmd = alloc_new_pmd(vma->vm_mm, vma, new_addr);
                 if (!new_pmd)
                         break;
                 next = (new_addr + PMD_SIZE) & PMD_MASK;
@@ -276,9 +276,16 @@ static struct vm_area_struct *vma_to_resize(unsigned long addr,
         if (old_len > vma->vm_end - addr)
                 goto Efault;
 
-        if (vma->vm_flags & (VM_DONTEXPAND | VM_PFNMAP)) {
-                if (new_len > old_len)
+        /* Need to be careful about a growing mapping */
+        if (new_len > old_len) {
+                unsigned long pgoff;
+
+                if (vma->vm_flags & (VM_DONTEXPAND | VM_PFNMAP))
                         goto Efault;
+                pgoff = (addr - vma->vm_start) >> PAGE_SHIFT;
+                pgoff += vma->vm_pgoff;
+                if (pgoff + (new_len >> PAGE_SHIFT) < pgoff)
+                        goto Einval;
         }
 
         if (vma->vm_flags & VM_LOCKED) {