mm: mmap: merge vma after call_mmap() if possible
The vm_flags may be changed after call_mmap() because drivers may set some flags for their own purpose. As a result, we failed to merge the adjacent vma due to the different vm_flags as userspace can't pass in the same one. Try to merge vma after call_mmap() to fix this issue. Signed-off-by: Hongxiang Lou <louhongxiang@huawei.com> Signed-off-by: Miaohe Lin <linmiaohe@huawei.com> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Reviewed-by: Andrew Morton <akpm@linux-foundation.org> Link: http://lkml.kernel.org/r/1594954065-23733-1-git-send-email-linmiaohe@huawei.com Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
This commit is contained in:
parent
eee07935bb
commit
d70cec8983
22
mm/mmap.c
22
mm/mmap.c
|
@ -1690,7 +1690,7 @@ unsigned long mmap_region(struct file *file, unsigned long addr,
|
|||
struct list_head *uf)
|
||||
{
|
||||
struct mm_struct *mm = current->mm;
|
||||
struct vm_area_struct *vma, *prev;
|
||||
struct vm_area_struct *vma, *prev, *merge;
|
||||
int error;
|
||||
struct rb_node **rb_link, *rb_parent;
|
||||
unsigned long charged = 0;
|
||||
|
@ -1774,6 +1774,25 @@ unsigned long mmap_region(struct file *file, unsigned long addr,
|
|||
if (error)
|
||||
goto unmap_and_free_vma;
|
||||
|
||||
/* If vm_flags changed after call_mmap(), we should try merge vma again
|
||||
* as we may succeed this time.
|
||||
*/
|
||||
if (unlikely(vm_flags != vma->vm_flags && prev)) {
|
||||
merge = vma_merge(mm, prev, vma->vm_start, vma->vm_end, vma->vm_flags,
|
||||
NULL, vma->vm_file, vma->vm_pgoff, NULL, NULL_VM_UFFD_CTX);
|
||||
if (merge) {
|
||||
fput(file);
|
||||
vm_area_free(vma);
|
||||
vma = merge;
|
||||
/* Update vm_flags and possible addr to pick up the change. We don't
|
||||
* warn here if addr changed as the vma is not linked by vma_link().
|
||||
*/
|
||||
addr = vma->vm_start;
|
||||
vm_flags = vma->vm_flags;
|
||||
goto unmap_writable;
|
||||
}
|
||||
}
|
||||
|
||||
/* Can addr have changed??
|
||||
*
|
||||
* Answer: Yes, several device drivers can do it in their
|
||||
|
@ -1796,6 +1815,7 @@ unsigned long mmap_region(struct file *file, unsigned long addr,
|
|||
vma_link(mm, vma, prev, rb_link, rb_parent);
|
||||
/* Once vma denies write, undo our temporary denial count */
|
||||
if (file) {
|
||||
unmap_writable:
|
||||
if (vm_flags & VM_SHARED)
|
||||
mapping_unmap_writable(file->f_mapping);
|
||||
if (vm_flags & VM_DENYWRITE)
|
||||
|
|
Loading…
Reference in New Issue