Linus Torvalds 982134ba62 mm: avoid wrapping vm_pgoff in mremap() ...

The normal mmap paths all avoid creating a mapping where the pgoff
inside the mapping could wrap around due to overflow.  However, an
expanding mremap() can take such a non-wrapping mapping and make it
bigger and cause a wrapping condition.

Noticed by Robert Swiecki when running a system call fuzzer, where it
caused a BUG_ON() due to terminally confusing the vma_prio_tree code.  A
vma dumping patch by Hugh then pinpointed the crazy wrapped case.

Reported-and-tested-by: Robert Swiecki <robert@swiecki.net>
Acked-by: Hugh Dickins <hughd@google.com>
Cc: stable@kernel.org
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

2011-04-07 07:35:51 -07:00

..

backing-dev.c

Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs-2.6

2011-03-24 19:01:30 -07:00

bootmem.c

crash_dump: export is_kdump_kernel to modules, consolidate elfcorehdr_addr, setup_elfcorehdr and saved_max_pfn

2011-03-23 19:47:19 -07:00

bounce.c

bounce: call flush_dcache_page() after bounce_copy_vec()

2010-09-09 18:57:25 -07:00

compaction.c

mm: compaction: minimise the time IRQs are disabled while isolating pages for migration

2011-03-22 17:44:05 -07:00

debug-pagealloc.c

generic debug pagealloc

2009-04-01 08:59:13 -07:00

dmapool.c

mm/dmapool.c: use TASK_UNINTERRUPTIBLE in dma_pool_alloc()

2011-01-13 17:32:48 -08:00

fadvise.c

readahead: introduce FMODE_RANDOM for POSIX_FADV_RANDOM

2010-03-06 11:26:25 -08:00

failslab.c

include cleanup: Update gfp.h and slab.h includes to prepare for breaking implicit slab.h inclusion from percpu.h

2010-03-30 22:02:32 +09:00

filemap_xip.c

include cleanup: Update gfp.h and slab.h includes to prepare for breaking implicit slab.h inclusion from percpu.h

2010-03-30 22:02:32 +09:00

filemap.c

Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs-2.6

2011-03-24 19:01:30 -07:00

fremap.c

Avoid pgoff overflow in remap_file_pages

2010-09-25 09:34:58 -07:00

highmem.c

mm,x86: fix kmap_atomic_push vs ioremap_32.c

2010-10-27 18:03:05 -07:00

huge_memory.c

mm: use __GFP_OTHER_NODE for transparent huge pages

2011-03-22 17:44:05 -07:00

hugetlb.c

hugetlbfs: correct handling of negative input to /proc/sys/vm/nr_hugepages

2011-03-22 17:44:04 -07:00

hwpoison-inject.c

HWPOISON, hugetlb: support hwpoison injection for hugepage

2010-08-11 09:23:11 +02:00

init-mm.c

mm: provide init_mm mm_context initializer

2010-08-09 20:44:54 -07:00

internal.h

mm: export __get_user_pages

2011-03-17 13:08:27 -03:00

Kconfig

mm: compaction: don't depend on HUGETLB_PAGE

2011-01-26 10:50:02 +10:00

Kconfig.debug

mm: debug-pagealloc: fix kconfig dependency warning

2011-03-22 17:44:02 -07:00

kmemcheck.c

kmemcheck: Fix build errors due to missing slab.h

2010-03-30 22:02:32 +09:00

kmemleak-test.c

kmemleak: remove memset by using kzalloc

2011-01-27 18:31:51 +00:00

kmemleak.c

kmemleak: Allow kmemleak metadata allocations to fail

2011-01-27 18:32:06 +00:00

ksm.c

mm: rename drop_anon_vma() to put_anon_vma()

2011-03-22 17:44:03 -07:00

maccess.c

MN10300: Save frame pointer in thread_info struct rather than global var

2010-10-27 17:29:01 +01:00

madvise.c

thp: khugepaged: make khugepaged aware about madvise

2011-01-13 17:32:47 -08:00

Makefile

bootmem: Separate out CONFIG_NO_BOOTMEM code into nobootmem.c

2011-02-24 14:43:05 +01:00

memblock.c

mm/memblock: properly handle overlaps and fix error path

2011-03-22 17:44:09 -07:00

memcontrol.c

memcg: fix leak on wrong LRU with FUSE

2011-03-23 19:46:33 -07:00

memory_hotplug.c

Merge branch 'slub/hotplug' into slab/urgent

2011-01-15 13:28:17 +02:00

memory-failure.c

Merge branch 'for-2.6.39/core' of git://git.kernel.dk/linux-2.6-block

2011-03-24 10:16:26 -07:00

memory.c

mm: fix memory.c incorrect kernel-doc

2011-03-27 19:30:18 -07:00

mempolicy.c

mempolicy: remove redundant check in __mpol_equal()

2011-03-22 17:44:04 -07:00

mempool.c

mm: remove broken 'kzalloc' mempool

2009-09-22 07:17:35 -07:00

migrate.c

memcg: fix ugly initialization of return value is in caller

2011-03-23 19:46:22 -07:00

mincore.c

thp: mincore transparent hugepage support

2011-01-13 17:32:44 -08:00

mlock.c

mm: arch: make get_gate_vma take an mm_struct instead of a task_struct

2011-03-23 16:36:54 -04:00

mm_init.c

mm: mminit_loglevel cannot be __meminitdata anymore

2008-08-20 15:40:30 -07:00

mmap.c

brk: fix min_brk lower bound computation for COMPAT_BRK

2011-01-13 17:32:48 -08:00

mmu_context.c

exit: fix oops in sync_mm_rss

2010-03-24 16:31:21 -07:00

mmu_notifier.c

thp: mmu_notifier_test_young

2011-01-13 17:32:46 -08:00

mmzone.c

mm: page allocator: adjust the per-cpu counter threshold when memory is low

2011-01-13 17:32:31 -08:00

mprotect.c

thp: mprotect: transparent huge page support

2011-01-13 17:32:44 -08:00

mremap.c

mm: avoid wrapping vm_pgoff in mremap()

2011-04-07 07:35:51 -07:00

msync.c

sanitize vfs_fsync calling conventions

2010-05-21 18:31:21 -04:00

nobootmem.c

crash_dump: export is_kdump_kernel to modules, consolidate elfcorehdr_addr, setup_elfcorehdr and saved_max_pfn

2011-03-23 19:47:19 -07:00

nommu.c

NOMMU: implement access_remote_vm

2011-03-29 14:05:12 +01:00

oom_kill.c

lib, arch: add filter argument to show_mem and fix private implementations

2011-03-24 17:49:37 -07:00

page_alloc.c

lib, arch: add filter argument to show_mem and fix private implementations

2011-03-24 17:49:37 -07:00

page_cgroup.c

memcg: page_cgroup array is never stored on reserved pages

2011-03-23 19:46:33 -07:00

page_io.c

block: kill off REQ_UNPLUG

2011-03-10 08:52:27 +01:00

page_isolation.c

mm: page_isolation: codeclean fix comment and rm unneeded val init

2010-10-26 16:52:11 -07:00

page-writeback.c

Merge branch 'for-2.6.39/core' of git://git.kernel.dk/linux-2.6-block

2011-03-24 10:16:26 -07:00

pagewalk.c

pagewalk: only split huge pages when necessary

2011-03-22 17:44:04 -07:00

percpu-km.c

percpu: clear memory allocated with the km allocator

2010-10-02 10:28:42 +03:00

percpu-vm.c

mm: remove gfp mask from pcpu_get_vm_areas

2011-01-13 17:32:34 -08:00

percpu.c

NOMMU: percpu should use is_vmalloc_addr().

2011-03-28 12:53:29 +01:00

pgtable-generic.c

mm/pgtable-generic.c: fix CONFIG_SWAP=n build

2011-01-26 10:49:58 +10:00

prio_tree.c

…

quicklist.c

include cleanup: Update gfp.h and slab.h includes to prepare for breaking implicit slab.h inclusion from percpu.h

2010-03-30 22:02:32 +09:00

readahead.c

read-ahead: use plugging

2011-03-10 08:52:26 +01:00

rmap.c

fs: move i_wb_list out from under inode_lock

2011-03-24 21:17:51 -04:00

shmem.c

Merge branch 'for-2.6.39/core' of git://git.kernel.dk/linux-2.6-block

2011-03-24 10:16:26 -07:00

slab.c

mm: notifier_from_errno() cleanup

2011-03-22 17:44:01 -07:00

slob.c

mm: Remove support for kmem_cache_name()

2011-01-23 21:00:05 +02:00

slub.c

SLUB: Write to per cpu data when allocating it

2011-03-24 21:53:07 +02:00

sparse-vmemmap.c

tree-wide: fix comment/printk typos

2010-11-01 15:38:34 -04:00

sparse.c

thp: remove PG_buddy

2011-01-13 17:32:43 -08:00

swap_state.c

block: remove per-queue plugging

2011-03-10 08:52:07 +01:00

swap.c

mm: simplify code of swap.c

2011-03-22 17:44:09 -07:00

swapfile.c

Merge branch 'for-2.6.39/core' of git://git.kernel.dk/linux-2.6-block

2011-03-24 10:16:26 -07:00

thrash.c

mm: pass mm to grab_swap_token

2009-06-23 12:50:05 -07:00

truncate.c

mm: deactivate invalidated pages

2011-03-22 17:44:03 -07:00

util.c

kernel: kmem_ptr_validate considered harmful

2011-01-07 17:50:16 +11:00

vmalloc.c

vmalloc: remove confusing comment on vwrite()

2011-03-22 17:44:09 -07:00

vmscan.c

Merge branch 'for-2.6.39/core' of git://git.kernel.dk/linux-2.6-block

2011-03-24 10:16:26 -07:00

vmstat.c

mm: add __GFP_OTHER_NODE flag

2011-03-22 17:44:05 -07:00