From: Helge Deller Date: Tue, 19 Dec 2006 18:28:33 +0000 (+0100) Subject: [PARISC] Handle wrapping in expand_upwards() X-Git-Tag: v2.6.22-rc6~42^2~2 X-Git-Url: http://ftp.safe.ca/?p=safe%2Fjmp%2Flinux-2.6;a=commitdiff_plain;h=06b32f3ab6df4c7489729f94bdc7093c72681d4b [PARISC] Handle wrapping in expand_upwards() Function expand_upwards() did not guarded against wrapping around to address 0. This fixes the adjtimex02 testcase from the Linux Test Project on a 32bit PARISC kernel. [expand_upwards is only used on parisc and ia64; it looks like it does the right thing on both. --kyle] Signed-off-by: Helge Deller Cc: Tony Luck Signed-off-by: Kyle McMartin --- diff --git a/mm/mmap.c b/mm/mmap.c index 68b9ad2..906ed40 100644 --- a/mm/mmap.c +++ b/mm/mmap.c @@ -1536,9 +1536,14 @@ int expand_upwards(struct vm_area_struct *vma, unsigned long address) * vma->vm_start/vm_end cannot change under us because the caller * is required to hold the mmap_sem in read mode. We need the * anon_vma lock to serialize against concurrent expand_stacks. + * Also guard against wrapping around to address 0. */ - address += 4 + PAGE_SIZE - 1; - address &= PAGE_MASK; + if (address < PAGE_ALIGN(address+4)) + address = PAGE_ALIGN(address+4); + else { + anon_vma_unlock(vma); + return -ENOMEM; + } error = 0; /* Somebody else might have raced and expanded it already */