xref: /openbmc/linux/mm/mmap.c (revision b830f94f)
1 // SPDX-License-Identifier: GPL-2.0-only
2 /*
3  * mm/mmap.c
4  *
5  * Written by obz.
6  *
7  * Address space accounting code	<alan@lxorguk.ukuu.org.uk>
8  */
9 
10 #define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
11 
12 #include <linux/kernel.h>
13 #include <linux/slab.h>
14 #include <linux/backing-dev.h>
15 #include <linux/mm.h>
16 #include <linux/vmacache.h>
17 #include <linux/shm.h>
18 #include <linux/mman.h>
19 #include <linux/pagemap.h>
20 #include <linux/swap.h>
21 #include <linux/syscalls.h>
22 #include <linux/capability.h>
23 #include <linux/init.h>
24 #include <linux/file.h>
25 #include <linux/fs.h>
26 #include <linux/personality.h>
27 #include <linux/security.h>
28 #include <linux/hugetlb.h>
29 #include <linux/shmem_fs.h>
30 #include <linux/profile.h>
31 #include <linux/export.h>
32 #include <linux/mount.h>
33 #include <linux/mempolicy.h>
34 #include <linux/rmap.h>
35 #include <linux/mmu_notifier.h>
36 #include <linux/mmdebug.h>
37 #include <linux/perf_event.h>
38 #include <linux/audit.h>
39 #include <linux/khugepaged.h>
40 #include <linux/uprobes.h>
41 #include <linux/rbtree_augmented.h>
42 #include <linux/notifier.h>
43 #include <linux/memory.h>
44 #include <linux/printk.h>
45 #include <linux/userfaultfd_k.h>
46 #include <linux/moduleparam.h>
47 #include <linux/pkeys.h>
48 #include <linux/oom.h>
49 #include <linux/sched/mm.h>
50 
51 #include <linux/uaccess.h>
52 #include <asm/cacheflush.h>
53 #include <asm/tlb.h>
54 #include <asm/mmu_context.h>
55 
56 #include "internal.h"
57 
58 #ifndef arch_mmap_check
59 #define arch_mmap_check(addr, len, flags)	(0)
60 #endif
61 
62 #ifdef CONFIG_HAVE_ARCH_MMAP_RND_BITS
63 const int mmap_rnd_bits_min = CONFIG_ARCH_MMAP_RND_BITS_MIN;
64 const int mmap_rnd_bits_max = CONFIG_ARCH_MMAP_RND_BITS_MAX;
65 int mmap_rnd_bits __read_mostly = CONFIG_ARCH_MMAP_RND_BITS;
66 #endif
67 #ifdef CONFIG_HAVE_ARCH_MMAP_RND_COMPAT_BITS
68 const int mmap_rnd_compat_bits_min = CONFIG_ARCH_MMAP_RND_COMPAT_BITS_MIN;
69 const int mmap_rnd_compat_bits_max = CONFIG_ARCH_MMAP_RND_COMPAT_BITS_MAX;
70 int mmap_rnd_compat_bits __read_mostly = CONFIG_ARCH_MMAP_RND_COMPAT_BITS;
71 #endif
72 
73 static bool ignore_rlimit_data;
74 core_param(ignore_rlimit_data, ignore_rlimit_data, bool, 0644);
75 
76 static void unmap_region(struct mm_struct *mm,
77 		struct vm_area_struct *vma, struct vm_area_struct *prev,
78 		unsigned long start, unsigned long end);
79 
80 /* description of effects of mapping type and prot in current implementation.
81  * this is due to the limited x86 page protection hardware.  The expected
82  * behavior is in parens:
83  *
84  * map_type	prot
85  *		PROT_NONE	PROT_READ	PROT_WRITE	PROT_EXEC
86  * MAP_SHARED	r: (no) no	r: (yes) yes	r: (no) yes	r: (no) yes
87  *		w: (no) no	w: (no) no	w: (yes) yes	w: (no) no
88  *		x: (no) no	x: (no) yes	x: (no) yes	x: (yes) yes
89  *
90  * MAP_PRIVATE	r: (no) no	r: (yes) yes	r: (no) yes	r: (no) yes
91  *		w: (no) no	w: (no) no	w: (copy) copy	w: (no) no
92  *		x: (no) no	x: (no) yes	x: (no) yes	x: (yes) yes
93  *
94  * On arm64, PROT_EXEC has the following behaviour for both MAP_SHARED and
95  * MAP_PRIVATE:
96  *								r: (no) no
97  *								w: (no) no
98  *								x: (yes) yes
99  */
100 pgprot_t protection_map[16] __ro_after_init = {
101 	__P000, __P001, __P010, __P011, __P100, __P101, __P110, __P111,
102 	__S000, __S001, __S010, __S011, __S100, __S101, __S110, __S111
103 };
104 
105 #ifndef CONFIG_ARCH_HAS_FILTER_PGPROT
106 static inline pgprot_t arch_filter_pgprot(pgprot_t prot)
107 {
108 	return prot;
109 }
110 #endif
111 
112 pgprot_t vm_get_page_prot(unsigned long vm_flags)
113 {
114 	pgprot_t ret = __pgprot(pgprot_val(protection_map[vm_flags &
115 				(VM_READ|VM_WRITE|VM_EXEC|VM_SHARED)]) |
116 			pgprot_val(arch_vm_get_page_prot(vm_flags)));
117 
118 	return arch_filter_pgprot(ret);
119 }
120 EXPORT_SYMBOL(vm_get_page_prot);
121 
122 static pgprot_t vm_pgprot_modify(pgprot_t oldprot, unsigned long vm_flags)
123 {
124 	return pgprot_modify(oldprot, vm_get_page_prot(vm_flags));
125 }
126 
127 /* Update vma->vm_page_prot to reflect vma->vm_flags. */
128 void vma_set_page_prot(struct vm_area_struct *vma)
129 {
130 	unsigned long vm_flags = vma->vm_flags;
131 	pgprot_t vm_page_prot;
132 
133 	vm_page_prot = vm_pgprot_modify(vma->vm_page_prot, vm_flags);
134 	if (vma_wants_writenotify(vma, vm_page_prot)) {
135 		vm_flags &= ~VM_SHARED;
136 		vm_page_prot = vm_pgprot_modify(vm_page_prot, vm_flags);
137 	}
138 	/* remove_protection_ptes reads vma->vm_page_prot without mmap_sem */
139 	WRITE_ONCE(vma->vm_page_prot, vm_page_prot);
140 }
141 
142 /*
143  * Requires inode->i_mapping->i_mmap_rwsem
144  */
145 static void __remove_shared_vm_struct(struct vm_area_struct *vma,
146 		struct file *file, struct address_space *mapping)
147 {
148 	if (vma->vm_flags & VM_DENYWRITE)
149 		atomic_inc(&file_inode(file)->i_writecount);
150 	if (vma->vm_flags & VM_SHARED)
151 		mapping_unmap_writable(mapping);
152 
153 	flush_dcache_mmap_lock(mapping);
154 	vma_interval_tree_remove(vma, &mapping->i_mmap);
155 	flush_dcache_mmap_unlock(mapping);
156 }
157 
158 /*
159  * Unlink a file-based vm structure from its interval tree, to hide
160  * vma from rmap and vmtruncate before freeing its page tables.
161  */
162 void unlink_file_vma(struct vm_area_struct *vma)
163 {
164 	struct file *file = vma->vm_file;
165 
166 	if (file) {
167 		struct address_space *mapping = file->f_mapping;
168 		i_mmap_lock_write(mapping);
169 		__remove_shared_vm_struct(vma, file, mapping);
170 		i_mmap_unlock_write(mapping);
171 	}
172 }
173 
174 /*
175  * Close a vm structure and free it, returning the next.
176  */
177 static struct vm_area_struct *remove_vma(struct vm_area_struct *vma)
178 {
179 	struct vm_area_struct *next = vma->vm_next;
180 
181 	might_sleep();
182 	if (vma->vm_ops && vma->vm_ops->close)
183 		vma->vm_ops->close(vma);
184 	if (vma->vm_file)
185 		fput(vma->vm_file);
186 	mpol_put(vma_policy(vma));
187 	vm_area_free(vma);
188 	return next;
189 }
190 
191 static int do_brk_flags(unsigned long addr, unsigned long request, unsigned long flags,
192 		struct list_head *uf);
193 SYSCALL_DEFINE1(brk, unsigned long, brk)
194 {
195 	unsigned long retval;
196 	unsigned long newbrk, oldbrk, origbrk;
197 	struct mm_struct *mm = current->mm;
198 	struct vm_area_struct *next;
199 	unsigned long min_brk;
200 	bool populate;
201 	bool downgraded = false;
202 	LIST_HEAD(uf);
203 
204 	if (down_write_killable(&mm->mmap_sem))
205 		return -EINTR;
206 
207 	origbrk = mm->brk;
208 
209 #ifdef CONFIG_COMPAT_BRK
210 	/*
211 	 * CONFIG_COMPAT_BRK can still be overridden by setting
212 	 * randomize_va_space to 2, which will still cause mm->start_brk
213 	 * to be arbitrarily shifted
214 	 */
215 	if (current->brk_randomized)
216 		min_brk = mm->start_brk;
217 	else
218 		min_brk = mm->end_data;
219 #else
220 	min_brk = mm->start_brk;
221 #endif
222 	if (brk < min_brk)
223 		goto out;
224 
225 	/*
226 	 * Check against rlimit here. If this check is done later after the test
227 	 * of oldbrk with newbrk then it can escape the test and let the data
228 	 * segment grow beyond its set limit the in case where the limit is
229 	 * not page aligned -Ram Gupta
230 	 */
231 	if (check_data_rlimit(rlimit(RLIMIT_DATA), brk, mm->start_brk,
232 			      mm->end_data, mm->start_data))
233 		goto out;
234 
235 	newbrk = PAGE_ALIGN(brk);
236 	oldbrk = PAGE_ALIGN(mm->brk);
237 	if (oldbrk == newbrk) {
238 		mm->brk = brk;
239 		goto success;
240 	}
241 
242 	/*
243 	 * Always allow shrinking brk.
244 	 * __do_munmap() may downgrade mmap_sem to read.
245 	 */
246 	if (brk <= mm->brk) {
247 		int ret;
248 
249 		/*
250 		 * mm->brk must to be protected by write mmap_sem so update it
251 		 * before downgrading mmap_sem. When __do_munmap() fails,
252 		 * mm->brk will be restored from origbrk.
253 		 */
254 		mm->brk = brk;
255 		ret = __do_munmap(mm, newbrk, oldbrk-newbrk, &uf, true);
256 		if (ret < 0) {
257 			mm->brk = origbrk;
258 			goto out;
259 		} else if (ret == 1) {
260 			downgraded = true;
261 		}
262 		goto success;
263 	}
264 
265 	/* Check against existing mmap mappings. */
266 	next = find_vma(mm, oldbrk);
267 	if (next && newbrk + PAGE_SIZE > vm_start_gap(next))
268 		goto out;
269 
270 	/* Ok, looks good - let it rip. */
271 	if (do_brk_flags(oldbrk, newbrk-oldbrk, 0, &uf) < 0)
272 		goto out;
273 	mm->brk = brk;
274 
275 success:
276 	populate = newbrk > oldbrk && (mm->def_flags & VM_LOCKED) != 0;
277 	if (downgraded)
278 		up_read(&mm->mmap_sem);
279 	else
280 		up_write(&mm->mmap_sem);
281 	userfaultfd_unmap_complete(mm, &uf);
282 	if (populate)
283 		mm_populate(oldbrk, newbrk - oldbrk);
284 	return brk;
285 
286 out:
287 	retval = origbrk;
288 	up_write(&mm->mmap_sem);
289 	return retval;
290 }
291 
292 static long vma_compute_subtree_gap(struct vm_area_struct *vma)
293 {
294 	unsigned long max, prev_end, subtree_gap;
295 
296 	/*
297 	 * Note: in the rare case of a VM_GROWSDOWN above a VM_GROWSUP, we
298 	 * allow two stack_guard_gaps between them here, and when choosing
299 	 * an unmapped area; whereas when expanding we only require one.
300 	 * That's a little inconsistent, but keeps the code here simpler.
301 	 */
302 	max = vm_start_gap(vma);
303 	if (vma->vm_prev) {
304 		prev_end = vm_end_gap(vma->vm_prev);
305 		if (max > prev_end)
306 			max -= prev_end;
307 		else
308 			max = 0;
309 	}
310 	if (vma->vm_rb.rb_left) {
311 		subtree_gap = rb_entry(vma->vm_rb.rb_left,
312 				struct vm_area_struct, vm_rb)->rb_subtree_gap;
313 		if (subtree_gap > max)
314 			max = subtree_gap;
315 	}
316 	if (vma->vm_rb.rb_right) {
317 		subtree_gap = rb_entry(vma->vm_rb.rb_right,
318 				struct vm_area_struct, vm_rb)->rb_subtree_gap;
319 		if (subtree_gap > max)
320 			max = subtree_gap;
321 	}
322 	return max;
323 }
324 
325 #ifdef CONFIG_DEBUG_VM_RB
326 static int browse_rb(struct mm_struct *mm)
327 {
328 	struct rb_root *root = &mm->mm_rb;
329 	int i = 0, j, bug = 0;
330 	struct rb_node *nd, *pn = NULL;
331 	unsigned long prev = 0, pend = 0;
332 
333 	for (nd = rb_first(root); nd; nd = rb_next(nd)) {
334 		struct vm_area_struct *vma;
335 		vma = rb_entry(nd, struct vm_area_struct, vm_rb);
336 		if (vma->vm_start < prev) {
337 			pr_emerg("vm_start %lx < prev %lx\n",
338 				  vma->vm_start, prev);
339 			bug = 1;
340 		}
341 		if (vma->vm_start < pend) {
342 			pr_emerg("vm_start %lx < pend %lx\n",
343 				  vma->vm_start, pend);
344 			bug = 1;
345 		}
346 		if (vma->vm_start > vma->vm_end) {
347 			pr_emerg("vm_start %lx > vm_end %lx\n",
348 				  vma->vm_start, vma->vm_end);
349 			bug = 1;
350 		}
351 		spin_lock(&mm->page_table_lock);
352 		if (vma->rb_subtree_gap != vma_compute_subtree_gap(vma)) {
353 			pr_emerg("free gap %lx, correct %lx\n",
354 			       vma->rb_subtree_gap,
355 			       vma_compute_subtree_gap(vma));
356 			bug = 1;
357 		}
358 		spin_unlock(&mm->page_table_lock);
359 		i++;
360 		pn = nd;
361 		prev = vma->vm_start;
362 		pend = vma->vm_end;
363 	}
364 	j = 0;
365 	for (nd = pn; nd; nd = rb_prev(nd))
366 		j++;
367 	if (i != j) {
368 		pr_emerg("backwards %d, forwards %d\n", j, i);
369 		bug = 1;
370 	}
371 	return bug ? -1 : i;
372 }
373 
374 static void validate_mm_rb(struct rb_root *root, struct vm_area_struct *ignore)
375 {
376 	struct rb_node *nd;
377 
378 	for (nd = rb_first(root); nd; nd = rb_next(nd)) {
379 		struct vm_area_struct *vma;
380 		vma = rb_entry(nd, struct vm_area_struct, vm_rb);
381 		VM_BUG_ON_VMA(vma != ignore &&
382 			vma->rb_subtree_gap != vma_compute_subtree_gap(vma),
383 			vma);
384 	}
385 }
386 
387 static void validate_mm(struct mm_struct *mm)
388 {
389 	int bug = 0;
390 	int i = 0;
391 	unsigned long highest_address = 0;
392 	struct vm_area_struct *vma = mm->mmap;
393 
394 	while (vma) {
395 		struct anon_vma *anon_vma = vma->anon_vma;
396 		struct anon_vma_chain *avc;
397 
398 		if (anon_vma) {
399 			anon_vma_lock_read(anon_vma);
400 			list_for_each_entry(avc, &vma->anon_vma_chain, same_vma)
401 				anon_vma_interval_tree_verify(avc);
402 			anon_vma_unlock_read(anon_vma);
403 		}
404 
405 		highest_address = vm_end_gap(vma);
406 		vma = vma->vm_next;
407 		i++;
408 	}
409 	if (i != mm->map_count) {
410 		pr_emerg("map_count %d vm_next %d\n", mm->map_count, i);
411 		bug = 1;
412 	}
413 	if (highest_address != mm->highest_vm_end) {
414 		pr_emerg("mm->highest_vm_end %lx, found %lx\n",
415 			  mm->highest_vm_end, highest_address);
416 		bug = 1;
417 	}
418 	i = browse_rb(mm);
419 	if (i != mm->map_count) {
420 		if (i != -1)
421 			pr_emerg("map_count %d rb %d\n", mm->map_count, i);
422 		bug = 1;
423 	}
424 	VM_BUG_ON_MM(bug, mm);
425 }
426 #else
427 #define validate_mm_rb(root, ignore) do { } while (0)
428 #define validate_mm(mm) do { } while (0)
429 #endif
430 
431 RB_DECLARE_CALLBACKS(static, vma_gap_callbacks, struct vm_area_struct, vm_rb,
432 		     unsigned long, rb_subtree_gap, vma_compute_subtree_gap)
433 
434 /*
435  * Update augmented rbtree rb_subtree_gap values after vma->vm_start or
436  * vma->vm_prev->vm_end values changed, without modifying the vma's position
437  * in the rbtree.
438  */
439 static void vma_gap_update(struct vm_area_struct *vma)
440 {
441 	/*
442 	 * As it turns out, RB_DECLARE_CALLBACKS() already created a callback
443 	 * function that does exactly what we want.
444 	 */
445 	vma_gap_callbacks_propagate(&vma->vm_rb, NULL);
446 }
447 
448 static inline void vma_rb_insert(struct vm_area_struct *vma,
449 				 struct rb_root *root)
450 {
451 	/* All rb_subtree_gap values must be consistent prior to insertion */
452 	validate_mm_rb(root, NULL);
453 
454 	rb_insert_augmented(&vma->vm_rb, root, &vma_gap_callbacks);
455 }
456 
457 static void __vma_rb_erase(struct vm_area_struct *vma, struct rb_root *root)
458 {
459 	/*
460 	 * Note rb_erase_augmented is a fairly large inline function,
461 	 * so make sure we instantiate it only once with our desired
462 	 * augmented rbtree callbacks.
463 	 */
464 	rb_erase_augmented(&vma->vm_rb, root, &vma_gap_callbacks);
465 }
466 
467 static __always_inline void vma_rb_erase_ignore(struct vm_area_struct *vma,
468 						struct rb_root *root,
469 						struct vm_area_struct *ignore)
470 {
471 	/*
472 	 * All rb_subtree_gap values must be consistent prior to erase,
473 	 * with the possible exception of the "next" vma being erased if
474 	 * next->vm_start was reduced.
475 	 */
476 	validate_mm_rb(root, ignore);
477 
478 	__vma_rb_erase(vma, root);
479 }
480 
481 static __always_inline void vma_rb_erase(struct vm_area_struct *vma,
482 					 struct rb_root *root)
483 {
484 	/*
485 	 * All rb_subtree_gap values must be consistent prior to erase,
486 	 * with the possible exception of the vma being erased.
487 	 */
488 	validate_mm_rb(root, vma);
489 
490 	__vma_rb_erase(vma, root);
491 }
492 
493 /*
494  * vma has some anon_vma assigned, and is already inserted on that
495  * anon_vma's interval trees.
496  *
497  * Before updating the vma's vm_start / vm_end / vm_pgoff fields, the
498  * vma must be removed from the anon_vma's interval trees using
499  * anon_vma_interval_tree_pre_update_vma().
500  *
501  * After the update, the vma will be reinserted using
502  * anon_vma_interval_tree_post_update_vma().
503  *
504  * The entire update must be protected by exclusive mmap_sem and by
505  * the root anon_vma's mutex.
506  */
507 static inline void
508 anon_vma_interval_tree_pre_update_vma(struct vm_area_struct *vma)
509 {
510 	struct anon_vma_chain *avc;
511 
512 	list_for_each_entry(avc, &vma->anon_vma_chain, same_vma)
513 		anon_vma_interval_tree_remove(avc, &avc->anon_vma->rb_root);
514 }
515 
516 static inline void
517 anon_vma_interval_tree_post_update_vma(struct vm_area_struct *vma)
518 {
519 	struct anon_vma_chain *avc;
520 
521 	list_for_each_entry(avc, &vma->anon_vma_chain, same_vma)
522 		anon_vma_interval_tree_insert(avc, &avc->anon_vma->rb_root);
523 }
524 
525 static int find_vma_links(struct mm_struct *mm, unsigned long addr,
526 		unsigned long end, struct vm_area_struct **pprev,
527 		struct rb_node ***rb_link, struct rb_node **rb_parent)
528 {
529 	struct rb_node **__rb_link, *__rb_parent, *rb_prev;
530 
531 	__rb_link = &mm->mm_rb.rb_node;
532 	rb_prev = __rb_parent = NULL;
533 
534 	while (*__rb_link) {
535 		struct vm_area_struct *vma_tmp;
536 
537 		__rb_parent = *__rb_link;
538 		vma_tmp = rb_entry(__rb_parent, struct vm_area_struct, vm_rb);
539 
540 		if (vma_tmp->vm_end > addr) {
541 			/* Fail if an existing vma overlaps the area */
542 			if (vma_tmp->vm_start < end)
543 				return -ENOMEM;
544 			__rb_link = &__rb_parent->rb_left;
545 		} else {
546 			rb_prev = __rb_parent;
547 			__rb_link = &__rb_parent->rb_right;
548 		}
549 	}
550 
551 	*pprev = NULL;
552 	if (rb_prev)
553 		*pprev = rb_entry(rb_prev, struct vm_area_struct, vm_rb);
554 	*rb_link = __rb_link;
555 	*rb_parent = __rb_parent;
556 	return 0;
557 }
558 
559 static unsigned long count_vma_pages_range(struct mm_struct *mm,
560 		unsigned long addr, unsigned long end)
561 {
562 	unsigned long nr_pages = 0;
563 	struct vm_area_struct *vma;
564 
565 	/* Find first overlaping mapping */
566 	vma = find_vma_intersection(mm, addr, end);
567 	if (!vma)
568 		return 0;
569 
570 	nr_pages = (min(end, vma->vm_end) -
571 		max(addr, vma->vm_start)) >> PAGE_SHIFT;
572 
573 	/* Iterate over the rest of the overlaps */
574 	for (vma = vma->vm_next; vma; vma = vma->vm_next) {
575 		unsigned long overlap_len;
576 
577 		if (vma->vm_start > end)
578 			break;
579 
580 		overlap_len = min(end, vma->vm_end) - vma->vm_start;
581 		nr_pages += overlap_len >> PAGE_SHIFT;
582 	}
583 
584 	return nr_pages;
585 }
586 
587 void __vma_link_rb(struct mm_struct *mm, struct vm_area_struct *vma,
588 		struct rb_node **rb_link, struct rb_node *rb_parent)
589 {
590 	/* Update tracking information for the gap following the new vma. */
591 	if (vma->vm_next)
592 		vma_gap_update(vma->vm_next);
593 	else
594 		mm->highest_vm_end = vm_end_gap(vma);
595 
596 	/*
597 	 * vma->vm_prev wasn't known when we followed the rbtree to find the
598 	 * correct insertion point for that vma. As a result, we could not
599 	 * update the vma vm_rb parents rb_subtree_gap values on the way down.
600 	 * So, we first insert the vma with a zero rb_subtree_gap value
601 	 * (to be consistent with what we did on the way down), and then
602 	 * immediately update the gap to the correct value. Finally we
603 	 * rebalance the rbtree after all augmented values have been set.
604 	 */
605 	rb_link_node(&vma->vm_rb, rb_parent, rb_link);
606 	vma->rb_subtree_gap = 0;
607 	vma_gap_update(vma);
608 	vma_rb_insert(vma, &mm->mm_rb);
609 }
610 
611 static void __vma_link_file(struct vm_area_struct *vma)
612 {
613 	struct file *file;
614 
615 	file = vma->vm_file;
616 	if (file) {
617 		struct address_space *mapping = file->f_mapping;
618 
619 		if (vma->vm_flags & VM_DENYWRITE)
620 			atomic_dec(&file_inode(file)->i_writecount);
621 		if (vma->vm_flags & VM_SHARED)
622 			atomic_inc(&mapping->i_mmap_writable);
623 
624 		flush_dcache_mmap_lock(mapping);
625 		vma_interval_tree_insert(vma, &mapping->i_mmap);
626 		flush_dcache_mmap_unlock(mapping);
627 	}
628 }
629 
630 static void
631 __vma_link(struct mm_struct *mm, struct vm_area_struct *vma,
632 	struct vm_area_struct *prev, struct rb_node **rb_link,
633 	struct rb_node *rb_parent)
634 {
635 	__vma_link_list(mm, vma, prev, rb_parent);
636 	__vma_link_rb(mm, vma, rb_link, rb_parent);
637 }
638 
639 static void vma_link(struct mm_struct *mm, struct vm_area_struct *vma,
640 			struct vm_area_struct *prev, struct rb_node **rb_link,
641 			struct rb_node *rb_parent)
642 {
643 	struct address_space *mapping = NULL;
644 
645 	if (vma->vm_file) {
646 		mapping = vma->vm_file->f_mapping;
647 		i_mmap_lock_write(mapping);
648 	}
649 
650 	__vma_link(mm, vma, prev, rb_link, rb_parent);
651 	__vma_link_file(vma);
652 
653 	if (mapping)
654 		i_mmap_unlock_write(mapping);
655 
656 	mm->map_count++;
657 	validate_mm(mm);
658 }
659 
660 /*
661  * Helper for vma_adjust() in the split_vma insert case: insert a vma into the
662  * mm's list and rbtree.  It has already been inserted into the interval tree.
663  */
664 static void __insert_vm_struct(struct mm_struct *mm, struct vm_area_struct *vma)
665 {
666 	struct vm_area_struct *prev;
667 	struct rb_node **rb_link, *rb_parent;
668 
669 	if (find_vma_links(mm, vma->vm_start, vma->vm_end,
670 			   &prev, &rb_link, &rb_parent))
671 		BUG();
672 	__vma_link(mm, vma, prev, rb_link, rb_parent);
673 	mm->map_count++;
674 }
675 
676 static __always_inline void __vma_unlink_common(struct mm_struct *mm,
677 						struct vm_area_struct *vma,
678 						struct vm_area_struct *prev,
679 						bool has_prev,
680 						struct vm_area_struct *ignore)
681 {
682 	struct vm_area_struct *next;
683 
684 	vma_rb_erase_ignore(vma, &mm->mm_rb, ignore);
685 	next = vma->vm_next;
686 	if (has_prev)
687 		prev->vm_next = next;
688 	else {
689 		prev = vma->vm_prev;
690 		if (prev)
691 			prev->vm_next = next;
692 		else
693 			mm->mmap = next;
694 	}
695 	if (next)
696 		next->vm_prev = prev;
697 
698 	/* Kill the cache */
699 	vmacache_invalidate(mm);
700 }
701 
702 static inline void __vma_unlink_prev(struct mm_struct *mm,
703 				     struct vm_area_struct *vma,
704 				     struct vm_area_struct *prev)
705 {
706 	__vma_unlink_common(mm, vma, prev, true, vma);
707 }
708 
709 /*
710  * We cannot adjust vm_start, vm_end, vm_pgoff fields of a vma that
711  * is already present in an i_mmap tree without adjusting the tree.
712  * The following helper function should be used when such adjustments
713  * are necessary.  The "insert" vma (if any) is to be inserted
714  * before we drop the necessary locks.
715  */
716 int __vma_adjust(struct vm_area_struct *vma, unsigned long start,
717 	unsigned long end, pgoff_t pgoff, struct vm_area_struct *insert,
718 	struct vm_area_struct *expand)
719 {
720 	struct mm_struct *mm = vma->vm_mm;
721 	struct vm_area_struct *next = vma->vm_next, *orig_vma = vma;
722 	struct address_space *mapping = NULL;
723 	struct rb_root_cached *root = NULL;
724 	struct anon_vma *anon_vma = NULL;
725 	struct file *file = vma->vm_file;
726 	bool start_changed = false, end_changed = false;
727 	long adjust_next = 0;
728 	int remove_next = 0;
729 
730 	if (next && !insert) {
731 		struct vm_area_struct *exporter = NULL, *importer = NULL;
732 
733 		if (end >= next->vm_end) {
734 			/*
735 			 * vma expands, overlapping all the next, and
736 			 * perhaps the one after too (mprotect case 6).
737 			 * The only other cases that gets here are
738 			 * case 1, case 7 and case 8.
739 			 */
740 			if (next == expand) {
741 				/*
742 				 * The only case where we don't expand "vma"
743 				 * and we expand "next" instead is case 8.
744 				 */
745 				VM_WARN_ON(end != next->vm_end);
746 				/*
747 				 * remove_next == 3 means we're
748 				 * removing "vma" and that to do so we
749 				 * swapped "vma" and "next".
750 				 */
751 				remove_next = 3;
752 				VM_WARN_ON(file != next->vm_file);
753 				swap(vma, next);
754 			} else {
755 				VM_WARN_ON(expand != vma);
756 				/*
757 				 * case 1, 6, 7, remove_next == 2 is case 6,
758 				 * remove_next == 1 is case 1 or 7.
759 				 */
760 				remove_next = 1 + (end > next->vm_end);
761 				VM_WARN_ON(remove_next == 2 &&
762 					   end != next->vm_next->vm_end);
763 				VM_WARN_ON(remove_next == 1 &&
764 					   end != next->vm_end);
765 				/* trim end to next, for case 6 first pass */
766 				end = next->vm_end;
767 			}
768 
769 			exporter = next;
770 			importer = vma;
771 
772 			/*
773 			 * If next doesn't have anon_vma, import from vma after
774 			 * next, if the vma overlaps with it.
775 			 */
776 			if (remove_next == 2 && !next->anon_vma)
777 				exporter = next->vm_next;
778 
779 		} else if (end > next->vm_start) {
780 			/*
781 			 * vma expands, overlapping part of the next:
782 			 * mprotect case 5 shifting the boundary up.
783 			 */
784 			adjust_next = (end - next->vm_start) >> PAGE_SHIFT;
785 			exporter = next;
786 			importer = vma;
787 			VM_WARN_ON(expand != importer);
788 		} else if (end < vma->vm_end) {
789 			/*
790 			 * vma shrinks, and !insert tells it's not
791 			 * split_vma inserting another: so it must be
792 			 * mprotect case 4 shifting the boundary down.
793 			 */
794 			adjust_next = -((vma->vm_end - end) >> PAGE_SHIFT);
795 			exporter = vma;
796 			importer = next;
797 			VM_WARN_ON(expand != importer);
798 		}
799 
800 		/*
801 		 * Easily overlooked: when mprotect shifts the boundary,
802 		 * make sure the expanding vma has anon_vma set if the
803 		 * shrinking vma had, to cover any anon pages imported.
804 		 */
805 		if (exporter && exporter->anon_vma && !importer->anon_vma) {
806 			int error;
807 
808 			importer->anon_vma = exporter->anon_vma;
809 			error = anon_vma_clone(importer, exporter);
810 			if (error)
811 				return error;
812 		}
813 	}
814 again:
815 	vma_adjust_trans_huge(orig_vma, start, end, adjust_next);
816 
817 	if (file) {
818 		mapping = file->f_mapping;
819 		root = &mapping->i_mmap;
820 		uprobe_munmap(vma, vma->vm_start, vma->vm_end);
821 
822 		if (adjust_next)
823 			uprobe_munmap(next, next->vm_start, next->vm_end);
824 
825 		i_mmap_lock_write(mapping);
826 		if (insert) {
827 			/*
828 			 * Put into interval tree now, so instantiated pages
829 			 * are visible to arm/parisc __flush_dcache_page
830 			 * throughout; but we cannot insert into address
831 			 * space until vma start or end is updated.
832 			 */
833 			__vma_link_file(insert);
834 		}
835 	}
836 
837 	anon_vma = vma->anon_vma;
838 	if (!anon_vma && adjust_next)
839 		anon_vma = next->anon_vma;
840 	if (anon_vma) {
841 		VM_WARN_ON(adjust_next && next->anon_vma &&
842 			   anon_vma != next->anon_vma);
843 		anon_vma_lock_write(anon_vma);
844 		anon_vma_interval_tree_pre_update_vma(vma);
845 		if (adjust_next)
846 			anon_vma_interval_tree_pre_update_vma(next);
847 	}
848 
849 	if (root) {
850 		flush_dcache_mmap_lock(mapping);
851 		vma_interval_tree_remove(vma, root);
852 		if (adjust_next)
853 			vma_interval_tree_remove(next, root);
854 	}
855 
856 	if (start != vma->vm_start) {
857 		vma->vm_start = start;
858 		start_changed = true;
859 	}
860 	if (end != vma->vm_end) {
861 		vma->vm_end = end;
862 		end_changed = true;
863 	}
864 	vma->vm_pgoff = pgoff;
865 	if (adjust_next) {
866 		next->vm_start += adjust_next << PAGE_SHIFT;
867 		next->vm_pgoff += adjust_next;
868 	}
869 
870 	if (root) {
871 		if (adjust_next)
872 			vma_interval_tree_insert(next, root);
873 		vma_interval_tree_insert(vma, root);
874 		flush_dcache_mmap_unlock(mapping);
875 	}
876 
877 	if (remove_next) {
878 		/*
879 		 * vma_merge has merged next into vma, and needs
880 		 * us to remove next before dropping the locks.
881 		 */
882 		if (remove_next != 3)
883 			__vma_unlink_prev(mm, next, vma);
884 		else
885 			/*
886 			 * vma is not before next if they've been
887 			 * swapped.
888 			 *
889 			 * pre-swap() next->vm_start was reduced so
890 			 * tell validate_mm_rb to ignore pre-swap()
891 			 * "next" (which is stored in post-swap()
892 			 * "vma").
893 			 */
894 			__vma_unlink_common(mm, next, NULL, false, vma);
895 		if (file)
896 			__remove_shared_vm_struct(next, file, mapping);
897 	} else if (insert) {
898 		/*
899 		 * split_vma has split insert from vma, and needs
900 		 * us to insert it before dropping the locks
901 		 * (it may either follow vma or precede it).
902 		 */
903 		__insert_vm_struct(mm, insert);
904 	} else {
905 		if (start_changed)
906 			vma_gap_update(vma);
907 		if (end_changed) {
908 			if (!next)
909 				mm->highest_vm_end = vm_end_gap(vma);
910 			else if (!adjust_next)
911 				vma_gap_update(next);
912 		}
913 	}
914 
915 	if (anon_vma) {
916 		anon_vma_interval_tree_post_update_vma(vma);
917 		if (adjust_next)
918 			anon_vma_interval_tree_post_update_vma(next);
919 		anon_vma_unlock_write(anon_vma);
920 	}
921 	if (mapping)
922 		i_mmap_unlock_write(mapping);
923 
924 	if (root) {
925 		uprobe_mmap(vma);
926 
927 		if (adjust_next)
928 			uprobe_mmap(next);
929 	}
930 
931 	if (remove_next) {
932 		if (file) {
933 			uprobe_munmap(next, next->vm_start, next->vm_end);
934 			fput(file);
935 		}
936 		if (next->anon_vma)
937 			anon_vma_merge(vma, next);
938 		mm->map_count--;
939 		mpol_put(vma_policy(next));
940 		vm_area_free(next);
941 		/*
942 		 * In mprotect's case 6 (see comments on vma_merge),
943 		 * we must remove another next too. It would clutter
944 		 * up the code too much to do both in one go.
945 		 */
946 		if (remove_next != 3) {
947 			/*
948 			 * If "next" was removed and vma->vm_end was
949 			 * expanded (up) over it, in turn
950 			 * "next->vm_prev->vm_end" changed and the
951 			 * "vma->vm_next" gap must be updated.
952 			 */
953 			next = vma->vm_next;
954 		} else {
955 			/*
956 			 * For the scope of the comment "next" and
957 			 * "vma" considered pre-swap(): if "vma" was
958 			 * removed, next->vm_start was expanded (down)
959 			 * over it and the "next" gap must be updated.
960 			 * Because of the swap() the post-swap() "vma"
961 			 * actually points to pre-swap() "next"
962 			 * (post-swap() "next" as opposed is now a
963 			 * dangling pointer).
964 			 */
965 			next = vma;
966 		}
967 		if (remove_next == 2) {
968 			remove_next = 1;
969 			end = next->vm_end;
970 			goto again;
971 		}
972 		else if (next)
973 			vma_gap_update(next);
974 		else {
975 			/*
976 			 * If remove_next == 2 we obviously can't
977 			 * reach this path.
978 			 *
979 			 * If remove_next == 3 we can't reach this
980 			 * path because pre-swap() next is always not
981 			 * NULL. pre-swap() "next" is not being
982 			 * removed and its next->vm_end is not altered
983 			 * (and furthermore "end" already matches
984 			 * next->vm_end in remove_next == 3).
985 			 *
986 			 * We reach this only in the remove_next == 1
987 			 * case if the "next" vma that was removed was
988 			 * the highest vma of the mm. However in such
989 			 * case next->vm_end == "end" and the extended
990 			 * "vma" has vma->vm_end == next->vm_end so
991 			 * mm->highest_vm_end doesn't need any update
992 			 * in remove_next == 1 case.
993 			 */
994 			VM_WARN_ON(mm->highest_vm_end != vm_end_gap(vma));
995 		}
996 	}
997 	if (insert && file)
998 		uprobe_mmap(insert);
999 
1000 	validate_mm(mm);
1001 
1002 	return 0;
1003 }
1004 
1005 /*
1006  * If the vma has a ->close operation then the driver probably needs to release
1007  * per-vma resources, so we don't attempt to merge those.
1008  */
1009 static inline int is_mergeable_vma(struct vm_area_struct *vma,
1010 				struct file *file, unsigned long vm_flags,
1011 				struct vm_userfaultfd_ctx vm_userfaultfd_ctx)
1012 {
1013 	/*
1014 	 * VM_SOFTDIRTY should not prevent from VMA merging, if we
1015 	 * match the flags but dirty bit -- the caller should mark
1016 	 * merged VMA as dirty. If dirty bit won't be excluded from
1017 	 * comparison, we increase pressure on the memory system forcing
1018 	 * the kernel to generate new VMAs when old one could be
1019 	 * extended instead.
1020 	 */
1021 	if ((vma->vm_flags ^ vm_flags) & ~VM_SOFTDIRTY)
1022 		return 0;
1023 	if (vma->vm_file != file)
1024 		return 0;
1025 	if (vma->vm_ops && vma->vm_ops->close)
1026 		return 0;
1027 	if (!is_mergeable_vm_userfaultfd_ctx(vma, vm_userfaultfd_ctx))
1028 		return 0;
1029 	return 1;
1030 }
1031 
1032 static inline int is_mergeable_anon_vma(struct anon_vma *anon_vma1,
1033 					struct anon_vma *anon_vma2,
1034 					struct vm_area_struct *vma)
1035 {
1036 	/*
1037 	 * The list_is_singular() test is to avoid merging VMA cloned from
1038 	 * parents. This can improve scalability caused by anon_vma lock.
1039 	 */
1040 	if ((!anon_vma1 || !anon_vma2) && (!vma ||
1041 		list_is_singular(&vma->anon_vma_chain)))
1042 		return 1;
1043 	return anon_vma1 == anon_vma2;
1044 }
1045 
1046 /*
1047  * Return true if we can merge this (vm_flags,anon_vma,file,vm_pgoff)
1048  * in front of (at a lower virtual address and file offset than) the vma.
1049  *
1050  * We cannot merge two vmas if they have differently assigned (non-NULL)
1051  * anon_vmas, nor if same anon_vma is assigned but offsets incompatible.
1052  *
1053  * We don't check here for the merged mmap wrapping around the end of pagecache
1054  * indices (16TB on ia32) because do_mmap_pgoff() does not permit mmap's which
1055  * wrap, nor mmaps which cover the final page at index -1UL.
1056  */
1057 static int
1058 can_vma_merge_before(struct vm_area_struct *vma, unsigned long vm_flags,
1059 		     struct anon_vma *anon_vma, struct file *file,
1060 		     pgoff_t vm_pgoff,
1061 		     struct vm_userfaultfd_ctx vm_userfaultfd_ctx)
1062 {
1063 	if (is_mergeable_vma(vma, file, vm_flags, vm_userfaultfd_ctx) &&
1064 	    is_mergeable_anon_vma(anon_vma, vma->anon_vma, vma)) {
1065 		if (vma->vm_pgoff == vm_pgoff)
1066 			return 1;
1067 	}
1068 	return 0;
1069 }
1070 
1071 /*
1072  * Return true if we can merge this (vm_flags,anon_vma,file,vm_pgoff)
1073  * beyond (at a higher virtual address and file offset than) the vma.
1074  *
1075  * We cannot merge two vmas if they have differently assigned (non-NULL)
1076  * anon_vmas, nor if same anon_vma is assigned but offsets incompatible.
1077  */
1078 static int
1079 can_vma_merge_after(struct vm_area_struct *vma, unsigned long vm_flags,
1080 		    struct anon_vma *anon_vma, struct file *file,
1081 		    pgoff_t vm_pgoff,
1082 		    struct vm_userfaultfd_ctx vm_userfaultfd_ctx)
1083 {
1084 	if (is_mergeable_vma(vma, file, vm_flags, vm_userfaultfd_ctx) &&
1085 	    is_mergeable_anon_vma(anon_vma, vma->anon_vma, vma)) {
1086 		pgoff_t vm_pglen;
1087 		vm_pglen = vma_pages(vma);
1088 		if (vma->vm_pgoff + vm_pglen == vm_pgoff)
1089 			return 1;
1090 	}
1091 	return 0;
1092 }
1093 
1094 /*
1095  * Given a mapping request (addr,end,vm_flags,file,pgoff), figure out
1096  * whether that can be merged with its predecessor or its successor.
1097  * Or both (it neatly fills a hole).
1098  *
1099  * In most cases - when called for mmap, brk or mremap - [addr,end) is
1100  * certain not to be mapped by the time vma_merge is called; but when
1101  * called for mprotect, it is certain to be already mapped (either at
1102  * an offset within prev, or at the start of next), and the flags of
1103  * this area are about to be changed to vm_flags - and the no-change
1104  * case has already been eliminated.
1105  *
1106  * The following mprotect cases have to be considered, where AAAA is
1107  * the area passed down from mprotect_fixup, never extending beyond one
1108  * vma, PPPPPP is the prev vma specified, and NNNNNN the next vma after:
1109  *
1110  *     AAAA             AAAA                AAAA          AAAA
1111  *    PPPPPPNNNNNN    PPPPPPNNNNNN    PPPPPPNNNNNN    PPPPNNNNXXXX
1112  *    cannot merge    might become    might become    might become
1113  *                    PPNNNNNNNNNN    PPPPPPPPPPNN    PPPPPPPPPPPP 6 or
1114  *    mmap, brk or    case 4 below    case 5 below    PPPPPPPPXXXX 7 or
1115  *    mremap move:                                    PPPPXXXXXXXX 8
1116  *        AAAA
1117  *    PPPP    NNNN    PPPPPPPPPPPP    PPPPPPPPNNNN    PPPPNNNNNNNN
1118  *    might become    case 1 below    case 2 below    case 3 below
1119  *
1120  * It is important for case 8 that the vma NNNN overlapping the
1121  * region AAAA is never going to extended over XXXX. Instead XXXX must
1122  * be extended in region AAAA and NNNN must be removed. This way in
1123  * all cases where vma_merge succeeds, the moment vma_adjust drops the
1124  * rmap_locks, the properties of the merged vma will be already
1125  * correct for the whole merged range. Some of those properties like
1126  * vm_page_prot/vm_flags may be accessed by rmap_walks and they must
1127  * be correct for the whole merged range immediately after the
1128  * rmap_locks are released. Otherwise if XXXX would be removed and
1129  * NNNN would be extended over the XXXX range, remove_migration_ptes
1130  * or other rmap walkers (if working on addresses beyond the "end"
1131  * parameter) may establish ptes with the wrong permissions of NNNN
1132  * instead of the right permissions of XXXX.
1133  */
1134 struct vm_area_struct *vma_merge(struct mm_struct *mm,
1135 			struct vm_area_struct *prev, unsigned long addr,
1136 			unsigned long end, unsigned long vm_flags,
1137 			struct anon_vma *anon_vma, struct file *file,
1138 			pgoff_t pgoff, struct mempolicy *policy,
1139 			struct vm_userfaultfd_ctx vm_userfaultfd_ctx)
1140 {
1141 	pgoff_t pglen = (end - addr) >> PAGE_SHIFT;
1142 	struct vm_area_struct *area, *next;
1143 	int err;
1144 
1145 	/*
1146 	 * We later require that vma->vm_flags == vm_flags,
1147 	 * so this tests vma->vm_flags & VM_SPECIAL, too.
1148 	 */
1149 	if (vm_flags & VM_SPECIAL)
1150 		return NULL;
1151 
1152 	if (prev)
1153 		next = prev->vm_next;
1154 	else
1155 		next = mm->mmap;
1156 	area = next;
1157 	if (area && area->vm_end == end)		/* cases 6, 7, 8 */
1158 		next = next->vm_next;
1159 
1160 	/* verify some invariant that must be enforced by the caller */
1161 	VM_WARN_ON(prev && addr <= prev->vm_start);
1162 	VM_WARN_ON(area && end > area->vm_end);
1163 	VM_WARN_ON(addr >= end);
1164 
1165 	/*
1166 	 * Can it merge with the predecessor?
1167 	 */
1168 	if (prev && prev->vm_end == addr &&
1169 			mpol_equal(vma_policy(prev), policy) &&
1170 			can_vma_merge_after(prev, vm_flags,
1171 					    anon_vma, file, pgoff,
1172 					    vm_userfaultfd_ctx)) {
1173 		/*
1174 		 * OK, it can.  Can we now merge in the successor as well?
1175 		 */
1176 		if (next && end == next->vm_start &&
1177 				mpol_equal(policy, vma_policy(next)) &&
1178 				can_vma_merge_before(next, vm_flags,
1179 						     anon_vma, file,
1180 						     pgoff+pglen,
1181 						     vm_userfaultfd_ctx) &&
1182 				is_mergeable_anon_vma(prev->anon_vma,
1183 						      next->anon_vma, NULL)) {
1184 							/* cases 1, 6 */
1185 			err = __vma_adjust(prev, prev->vm_start,
1186 					 next->vm_end, prev->vm_pgoff, NULL,
1187 					 prev);
1188 		} else					/* cases 2, 5, 7 */
1189 			err = __vma_adjust(prev, prev->vm_start,
1190 					 end, prev->vm_pgoff, NULL, prev);
1191 		if (err)
1192 			return NULL;
1193 		khugepaged_enter_vma_merge(prev, vm_flags);
1194 		return prev;
1195 	}
1196 
1197 	/*
1198 	 * Can this new request be merged in front of next?
1199 	 */
1200 	if (next && end == next->vm_start &&
1201 			mpol_equal(policy, vma_policy(next)) &&
1202 			can_vma_merge_before(next, vm_flags,
1203 					     anon_vma, file, pgoff+pglen,
1204 					     vm_userfaultfd_ctx)) {
1205 		if (prev && addr < prev->vm_end)	/* case 4 */
1206 			err = __vma_adjust(prev, prev->vm_start,
1207 					 addr, prev->vm_pgoff, NULL, next);
1208 		else {					/* cases 3, 8 */
1209 			err = __vma_adjust(area, addr, next->vm_end,
1210 					 next->vm_pgoff - pglen, NULL, next);
1211 			/*
1212 			 * In case 3 area is already equal to next and
1213 			 * this is a noop, but in case 8 "area" has
1214 			 * been removed and next was expanded over it.
1215 			 */
1216 			area = next;
1217 		}
1218 		if (err)
1219 			return NULL;
1220 		khugepaged_enter_vma_merge(area, vm_flags);
1221 		return area;
1222 	}
1223 
1224 	return NULL;
1225 }
1226 
1227 /*
1228  * Rough compatbility check to quickly see if it's even worth looking
1229  * at sharing an anon_vma.
1230  *
1231  * They need to have the same vm_file, and the flags can only differ
1232  * in things that mprotect may change.
1233  *
1234  * NOTE! The fact that we share an anon_vma doesn't _have_ to mean that
1235  * we can merge the two vma's. For example, we refuse to merge a vma if
1236  * there is a vm_ops->close() function, because that indicates that the
1237  * driver is doing some kind of reference counting. But that doesn't
1238  * really matter for the anon_vma sharing case.
1239  */
1240 static int anon_vma_compatible(struct vm_area_struct *a, struct vm_area_struct *b)
1241 {
1242 	return a->vm_end == b->vm_start &&
1243 		mpol_equal(vma_policy(a), vma_policy(b)) &&
1244 		a->vm_file == b->vm_file &&
1245 		!((a->vm_flags ^ b->vm_flags) & ~(VM_READ|VM_WRITE|VM_EXEC|VM_SOFTDIRTY)) &&
1246 		b->vm_pgoff == a->vm_pgoff + ((b->vm_start - a->vm_start) >> PAGE_SHIFT);
1247 }
1248 
1249 /*
1250  * Do some basic sanity checking to see if we can re-use the anon_vma
1251  * from 'old'. The 'a'/'b' vma's are in VM order - one of them will be
1252  * the same as 'old', the other will be the new one that is trying
1253  * to share the anon_vma.
1254  *
1255  * NOTE! This runs with mm_sem held for reading, so it is possible that
1256  * the anon_vma of 'old' is concurrently in the process of being set up
1257  * by another page fault trying to merge _that_. But that's ok: if it
1258  * is being set up, that automatically means that it will be a singleton
1259  * acceptable for merging, so we can do all of this optimistically. But
1260  * we do that READ_ONCE() to make sure that we never re-load the pointer.
1261  *
1262  * IOW: that the "list_is_singular()" test on the anon_vma_chain only
1263  * matters for the 'stable anon_vma' case (ie the thing we want to avoid
1264  * is to return an anon_vma that is "complex" due to having gone through
1265  * a fork).
1266  *
1267  * We also make sure that the two vma's are compatible (adjacent,
1268  * and with the same memory policies). That's all stable, even with just
1269  * a read lock on the mm_sem.
1270  */
1271 static struct anon_vma *reusable_anon_vma(struct vm_area_struct *old, struct vm_area_struct *a, struct vm_area_struct *b)
1272 {
1273 	if (anon_vma_compatible(a, b)) {
1274 		struct anon_vma *anon_vma = READ_ONCE(old->anon_vma);
1275 
1276 		if (anon_vma && list_is_singular(&old->anon_vma_chain))
1277 			return anon_vma;
1278 	}
1279 	return NULL;
1280 }
1281 
1282 /*
1283  * find_mergeable_anon_vma is used by anon_vma_prepare, to check
1284  * neighbouring vmas for a suitable anon_vma, before it goes off
1285  * to allocate a new anon_vma.  It checks because a repetitive
1286  * sequence of mprotects and faults may otherwise lead to distinct
1287  * anon_vmas being allocated, preventing vma merge in subsequent
1288  * mprotect.
1289  */
1290 struct anon_vma *find_mergeable_anon_vma(struct vm_area_struct *vma)
1291 {
1292 	struct anon_vma *anon_vma;
1293 	struct vm_area_struct *near;
1294 
1295 	near = vma->vm_next;
1296 	if (!near)
1297 		goto try_prev;
1298 
1299 	anon_vma = reusable_anon_vma(near, vma, near);
1300 	if (anon_vma)
1301 		return anon_vma;
1302 try_prev:
1303 	near = vma->vm_prev;
1304 	if (!near)
1305 		goto none;
1306 
1307 	anon_vma = reusable_anon_vma(near, near, vma);
1308 	if (anon_vma)
1309 		return anon_vma;
1310 none:
1311 	/*
1312 	 * There's no absolute need to look only at touching neighbours:
1313 	 * we could search further afield for "compatible" anon_vmas.
1314 	 * But it would probably just be a waste of time searching,
1315 	 * or lead to too many vmas hanging off the same anon_vma.
1316 	 * We're trying to allow mprotect remerging later on,
1317 	 * not trying to minimize memory used for anon_vmas.
1318 	 */
1319 	return NULL;
1320 }
1321 
1322 /*
1323  * If a hint addr is less than mmap_min_addr change hint to be as
1324  * low as possible but still greater than mmap_min_addr
1325  */
1326 static inline unsigned long round_hint_to_min(unsigned long hint)
1327 {
1328 	hint &= PAGE_MASK;
1329 	if (((void *)hint != NULL) &&
1330 	    (hint < mmap_min_addr))
1331 		return PAGE_ALIGN(mmap_min_addr);
1332 	return hint;
1333 }
1334 
1335 static inline int mlock_future_check(struct mm_struct *mm,
1336 				     unsigned long flags,
1337 				     unsigned long len)
1338 {
1339 	unsigned long locked, lock_limit;
1340 
1341 	/*  mlock MCL_FUTURE? */
1342 	if (flags & VM_LOCKED) {
1343 		locked = len >> PAGE_SHIFT;
1344 		locked += mm->locked_vm;
1345 		lock_limit = rlimit(RLIMIT_MEMLOCK);
1346 		lock_limit >>= PAGE_SHIFT;
1347 		if (locked > lock_limit && !capable(CAP_IPC_LOCK))
1348 			return -EAGAIN;
1349 	}
1350 	return 0;
1351 }
1352 
1353 static inline u64 file_mmap_size_max(struct file *file, struct inode *inode)
1354 {
1355 	if (S_ISREG(inode->i_mode))
1356 		return MAX_LFS_FILESIZE;
1357 
1358 	if (S_ISBLK(inode->i_mode))
1359 		return MAX_LFS_FILESIZE;
1360 
1361 	/* Special "we do even unsigned file positions" case */
1362 	if (file->f_mode & FMODE_UNSIGNED_OFFSET)
1363 		return 0;
1364 
1365 	/* Yes, random drivers might want more. But I'm tired of buggy drivers */
1366 	return ULONG_MAX;
1367 }
1368 
1369 static inline bool file_mmap_ok(struct file *file, struct inode *inode,
1370 				unsigned long pgoff, unsigned long len)
1371 {
1372 	u64 maxsize = file_mmap_size_max(file, inode);
1373 
1374 	if (maxsize && len > maxsize)
1375 		return false;
1376 	maxsize -= len;
1377 	if (pgoff > maxsize >> PAGE_SHIFT)
1378 		return false;
1379 	return true;
1380 }
1381 
1382 /*
1383  * The caller must hold down_write(&current->mm->mmap_sem).
1384  */
1385 unsigned long do_mmap(struct file *file, unsigned long addr,
1386 			unsigned long len, unsigned long prot,
1387 			unsigned long flags, vm_flags_t vm_flags,
1388 			unsigned long pgoff, unsigned long *populate,
1389 			struct list_head *uf)
1390 {
1391 	struct mm_struct *mm = current->mm;
1392 	int pkey = 0;
1393 
1394 	*populate = 0;
1395 
1396 	if (!len)
1397 		return -EINVAL;
1398 
1399 	/*
1400 	 * Does the application expect PROT_READ to imply PROT_EXEC?
1401 	 *
1402 	 * (the exception is when the underlying filesystem is noexec
1403 	 *  mounted, in which case we dont add PROT_EXEC.)
1404 	 */
1405 	if ((prot & PROT_READ) && (current->personality & READ_IMPLIES_EXEC))
1406 		if (!(file && path_noexec(&file->f_path)))
1407 			prot |= PROT_EXEC;
1408 
1409 	/* force arch specific MAP_FIXED handling in get_unmapped_area */
1410 	if (flags & MAP_FIXED_NOREPLACE)
1411 		flags |= MAP_FIXED;
1412 
1413 	if (!(flags & MAP_FIXED))
1414 		addr = round_hint_to_min(addr);
1415 
1416 	/* Careful about overflows.. */
1417 	len = PAGE_ALIGN(len);
1418 	if (!len)
1419 		return -ENOMEM;
1420 
1421 	/* offset overflow? */
1422 	if ((pgoff + (len >> PAGE_SHIFT)) < pgoff)
1423 		return -EOVERFLOW;
1424 
1425 	/* Too many mappings? */
1426 	if (mm->map_count > sysctl_max_map_count)
1427 		return -ENOMEM;
1428 
1429 	/* Obtain the address to map to. we verify (or select) it and ensure
1430 	 * that it represents a valid section of the address space.
1431 	 */
1432 	addr = get_unmapped_area(file, addr, len, pgoff, flags);
1433 	if (offset_in_page(addr))
1434 		return addr;
1435 
1436 	if (flags & MAP_FIXED_NOREPLACE) {
1437 		struct vm_area_struct *vma = find_vma(mm, addr);
1438 
1439 		if (vma && vma->vm_start < addr + len)
1440 			return -EEXIST;
1441 	}
1442 
1443 	if (prot == PROT_EXEC) {
1444 		pkey = execute_only_pkey(mm);
1445 		if (pkey < 0)
1446 			pkey = 0;
1447 	}
1448 
1449 	/* Do simple checking here so the lower-level routines won't have
1450 	 * to. we assume access permissions have been handled by the open
1451 	 * of the memory object, so we don't do any here.
1452 	 */
1453 	vm_flags |= calc_vm_prot_bits(prot, pkey) | calc_vm_flag_bits(flags) |
1454 			mm->def_flags | VM_MAYREAD | VM_MAYWRITE | VM_MAYEXEC;
1455 
1456 	if (flags & MAP_LOCKED)
1457 		if (!can_do_mlock())
1458 			return -EPERM;
1459 
1460 	if (mlock_future_check(mm, vm_flags, len))
1461 		return -EAGAIN;
1462 
1463 	if (file) {
1464 		struct inode *inode = file_inode(file);
1465 		unsigned long flags_mask;
1466 
1467 		if (!file_mmap_ok(file, inode, pgoff, len))
1468 			return -EOVERFLOW;
1469 
1470 		flags_mask = LEGACY_MAP_MASK | file->f_op->mmap_supported_flags;
1471 
1472 		switch (flags & MAP_TYPE) {
1473 		case MAP_SHARED:
1474 			/*
1475 			 * Force use of MAP_SHARED_VALIDATE with non-legacy
1476 			 * flags. E.g. MAP_SYNC is dangerous to use with
1477 			 * MAP_SHARED as you don't know which consistency model
1478 			 * you will get. We silently ignore unsupported flags
1479 			 * with MAP_SHARED to preserve backward compatibility.
1480 			 */
1481 			flags &= LEGACY_MAP_MASK;
1482 			/* fall through */
1483 		case MAP_SHARED_VALIDATE:
1484 			if (flags & ~flags_mask)
1485 				return -EOPNOTSUPP;
1486 			if ((prot&PROT_WRITE) && !(file->f_mode&FMODE_WRITE))
1487 				return -EACCES;
1488 
1489 			/*
1490 			 * Make sure we don't allow writing to an append-only
1491 			 * file..
1492 			 */
1493 			if (IS_APPEND(inode) && (file->f_mode & FMODE_WRITE))
1494 				return -EACCES;
1495 
1496 			/*
1497 			 * Make sure there are no mandatory locks on the file.
1498 			 */
1499 			if (locks_verify_locked(file))
1500 				return -EAGAIN;
1501 
1502 			vm_flags |= VM_SHARED | VM_MAYSHARE;
1503 			if (!(file->f_mode & FMODE_WRITE))
1504 				vm_flags &= ~(VM_MAYWRITE | VM_SHARED);
1505 
1506 			/* fall through */
1507 		case MAP_PRIVATE:
1508 			if (!(file->f_mode & FMODE_READ))
1509 				return -EACCES;
1510 			if (path_noexec(&file->f_path)) {
1511 				if (vm_flags & VM_EXEC)
1512 					return -EPERM;
1513 				vm_flags &= ~VM_MAYEXEC;
1514 			}
1515 
1516 			if (!file->f_op->mmap)
1517 				return -ENODEV;
1518 			if (vm_flags & (VM_GROWSDOWN|VM_GROWSUP))
1519 				return -EINVAL;
1520 			break;
1521 
1522 		default:
1523 			return -EINVAL;
1524 		}
1525 	} else {
1526 		switch (flags & MAP_TYPE) {
1527 		case MAP_SHARED:
1528 			if (vm_flags & (VM_GROWSDOWN|VM_GROWSUP))
1529 				return -EINVAL;
1530 			/*
1531 			 * Ignore pgoff.
1532 			 */
1533 			pgoff = 0;
1534 			vm_flags |= VM_SHARED | VM_MAYSHARE;
1535 			break;
1536 		case MAP_PRIVATE:
1537 			/*
1538 			 * Set pgoff according to addr for anon_vma.
1539 			 */
1540 			pgoff = addr >> PAGE_SHIFT;
1541 			break;
1542 		default:
1543 			return -EINVAL;
1544 		}
1545 	}
1546 
1547 	/*
1548 	 * Set 'VM_NORESERVE' if we should not account for the
1549 	 * memory use of this mapping.
1550 	 */
1551 	if (flags & MAP_NORESERVE) {
1552 		/* We honor MAP_NORESERVE if allowed to overcommit */
1553 		if (sysctl_overcommit_memory != OVERCOMMIT_NEVER)
1554 			vm_flags |= VM_NORESERVE;
1555 
1556 		/* hugetlb applies strict overcommit unless MAP_NORESERVE */
1557 		if (file && is_file_hugepages(file))
1558 			vm_flags |= VM_NORESERVE;
1559 	}
1560 
1561 	addr = mmap_region(file, addr, len, vm_flags, pgoff, uf);
1562 	if (!IS_ERR_VALUE(addr) &&
1563 	    ((vm_flags & VM_LOCKED) ||
1564 	     (flags & (MAP_POPULATE | MAP_NONBLOCK)) == MAP_POPULATE))
1565 		*populate = len;
1566 	return addr;
1567 }
1568 
1569 unsigned long ksys_mmap_pgoff(unsigned long addr, unsigned long len,
1570 			      unsigned long prot, unsigned long flags,
1571 			      unsigned long fd, unsigned long pgoff)
1572 {
1573 	struct file *file = NULL;
1574 	unsigned long retval;
1575 
1576 	if (!(flags & MAP_ANONYMOUS)) {
1577 		audit_mmap_fd(fd, flags);
1578 		file = fget(fd);
1579 		if (!file)
1580 			return -EBADF;
1581 		if (is_file_hugepages(file))
1582 			len = ALIGN(len, huge_page_size(hstate_file(file)));
1583 		retval = -EINVAL;
1584 		if (unlikely(flags & MAP_HUGETLB && !is_file_hugepages(file)))
1585 			goto out_fput;
1586 	} else if (flags & MAP_HUGETLB) {
1587 		struct user_struct *user = NULL;
1588 		struct hstate *hs;
1589 
1590 		hs = hstate_sizelog((flags >> MAP_HUGE_SHIFT) & MAP_HUGE_MASK);
1591 		if (!hs)
1592 			return -EINVAL;
1593 
1594 		len = ALIGN(len, huge_page_size(hs));
1595 		/*
1596 		 * VM_NORESERVE is used because the reservations will be
1597 		 * taken when vm_ops->mmap() is called
1598 		 * A dummy user value is used because we are not locking
1599 		 * memory so no accounting is necessary
1600 		 */
1601 		file = hugetlb_file_setup(HUGETLB_ANON_FILE, len,
1602 				VM_NORESERVE,
1603 				&user, HUGETLB_ANONHUGE_INODE,
1604 				(flags >> MAP_HUGE_SHIFT) & MAP_HUGE_MASK);
1605 		if (IS_ERR(file))
1606 			return PTR_ERR(file);
1607 	}
1608 
1609 	flags &= ~(MAP_EXECUTABLE | MAP_DENYWRITE);
1610 
1611 	retval = vm_mmap_pgoff(file, addr, len, prot, flags, pgoff);
1612 out_fput:
1613 	if (file)
1614 		fput(file);
1615 	return retval;
1616 }
1617 
1618 SYSCALL_DEFINE6(mmap_pgoff, unsigned long, addr, unsigned long, len,
1619 		unsigned long, prot, unsigned long, flags,
1620 		unsigned long, fd, unsigned long, pgoff)
1621 {
1622 	return ksys_mmap_pgoff(addr, len, prot, flags, fd, pgoff);
1623 }
1624 
1625 #ifdef __ARCH_WANT_SYS_OLD_MMAP
1626 struct mmap_arg_struct {
1627 	unsigned long addr;
1628 	unsigned long len;
1629 	unsigned long prot;
1630 	unsigned long flags;
1631 	unsigned long fd;
1632 	unsigned long offset;
1633 };
1634 
1635 SYSCALL_DEFINE1(old_mmap, struct mmap_arg_struct __user *, arg)
1636 {
1637 	struct mmap_arg_struct a;
1638 
1639 	if (copy_from_user(&a, arg, sizeof(a)))
1640 		return -EFAULT;
1641 	if (offset_in_page(a.offset))
1642 		return -EINVAL;
1643 
1644 	return ksys_mmap_pgoff(a.addr, a.len, a.prot, a.flags, a.fd,
1645 			       a.offset >> PAGE_SHIFT);
1646 }
1647 #endif /* __ARCH_WANT_SYS_OLD_MMAP */
1648 
1649 /*
1650  * Some shared mappings will want the pages marked read-only
1651  * to track write events. If so, we'll downgrade vm_page_prot
1652  * to the private version (using protection_map[] without the
1653  * VM_SHARED bit).
1654  */
1655 int vma_wants_writenotify(struct vm_area_struct *vma, pgprot_t vm_page_prot)
1656 {
1657 	vm_flags_t vm_flags = vma->vm_flags;
1658 	const struct vm_operations_struct *vm_ops = vma->vm_ops;
1659 
1660 	/* If it was private or non-writable, the write bit is already clear */
1661 	if ((vm_flags & (VM_WRITE|VM_SHARED)) != ((VM_WRITE|VM_SHARED)))
1662 		return 0;
1663 
1664 	/* The backer wishes to know when pages are first written to? */
1665 	if (vm_ops && (vm_ops->page_mkwrite || vm_ops->pfn_mkwrite))
1666 		return 1;
1667 
1668 	/* The open routine did something to the protections that pgprot_modify
1669 	 * won't preserve? */
1670 	if (pgprot_val(vm_page_prot) !=
1671 	    pgprot_val(vm_pgprot_modify(vm_page_prot, vm_flags)))
1672 		return 0;
1673 
1674 	/* Do we need to track softdirty? */
1675 	if (IS_ENABLED(CONFIG_MEM_SOFT_DIRTY) && !(vm_flags & VM_SOFTDIRTY))
1676 		return 1;
1677 
1678 	/* Specialty mapping? */
1679 	if (vm_flags & VM_PFNMAP)
1680 		return 0;
1681 
1682 	/* Can the mapping track the dirty pages? */
1683 	return vma->vm_file && vma->vm_file->f_mapping &&
1684 		mapping_cap_account_dirty(vma->vm_file->f_mapping);
1685 }
1686 
1687 /*
1688  * We account for memory if it's a private writeable mapping,
1689  * not hugepages and VM_NORESERVE wasn't set.
1690  */
1691 static inline int accountable_mapping(struct file *file, vm_flags_t vm_flags)
1692 {
1693 	/*
1694 	 * hugetlb has its own accounting separate from the core VM
1695 	 * VM_HUGETLB may not be set yet so we cannot check for that flag.
1696 	 */
1697 	if (file && is_file_hugepages(file))
1698 		return 0;
1699 
1700 	return (vm_flags & (VM_NORESERVE | VM_SHARED | VM_WRITE)) == VM_WRITE;
1701 }
1702 
1703 unsigned long mmap_region(struct file *file, unsigned long addr,
1704 		unsigned long len, vm_flags_t vm_flags, unsigned long pgoff,
1705 		struct list_head *uf)
1706 {
1707 	struct mm_struct *mm = current->mm;
1708 	struct vm_area_struct *vma, *prev;
1709 	int error;
1710 	struct rb_node **rb_link, *rb_parent;
1711 	unsigned long charged = 0;
1712 
1713 	/* Check against address space limit. */
1714 	if (!may_expand_vm(mm, vm_flags, len >> PAGE_SHIFT)) {
1715 		unsigned long nr_pages;
1716 
1717 		/*
1718 		 * MAP_FIXED may remove pages of mappings that intersects with
1719 		 * requested mapping. Account for the pages it would unmap.
1720 		 */
1721 		nr_pages = count_vma_pages_range(mm, addr, addr + len);
1722 
1723 		if (!may_expand_vm(mm, vm_flags,
1724 					(len >> PAGE_SHIFT) - nr_pages))
1725 			return -ENOMEM;
1726 	}
1727 
1728 	/* Clear old maps */
1729 	while (find_vma_links(mm, addr, addr + len, &prev, &rb_link,
1730 			      &rb_parent)) {
1731 		if (do_munmap(mm, addr, len, uf))
1732 			return -ENOMEM;
1733 	}
1734 
1735 	/*
1736 	 * Private writable mapping: check memory availability
1737 	 */
1738 	if (accountable_mapping(file, vm_flags)) {
1739 		charged = len >> PAGE_SHIFT;
1740 		if (security_vm_enough_memory_mm(mm, charged))
1741 			return -ENOMEM;
1742 		vm_flags |= VM_ACCOUNT;
1743 	}
1744 
1745 	/*
1746 	 * Can we just expand an old mapping?
1747 	 */
1748 	vma = vma_merge(mm, prev, addr, addr + len, vm_flags,
1749 			NULL, file, pgoff, NULL, NULL_VM_UFFD_CTX);
1750 	if (vma)
1751 		goto out;
1752 
1753 	/*
1754 	 * Determine the object being mapped and call the appropriate
1755 	 * specific mapper. the address has already been validated, but
1756 	 * not unmapped, but the maps are removed from the list.
1757 	 */
1758 	vma = vm_area_alloc(mm);
1759 	if (!vma) {
1760 		error = -ENOMEM;
1761 		goto unacct_error;
1762 	}
1763 
1764 	vma->vm_start = addr;
1765 	vma->vm_end = addr + len;
1766 	vma->vm_flags = vm_flags;
1767 	vma->vm_page_prot = vm_get_page_prot(vm_flags);
1768 	vma->vm_pgoff = pgoff;
1769 
1770 	if (file) {
1771 		if (vm_flags & VM_DENYWRITE) {
1772 			error = deny_write_access(file);
1773 			if (error)
1774 				goto free_vma;
1775 		}
1776 		if (vm_flags & VM_SHARED) {
1777 			error = mapping_map_writable(file->f_mapping);
1778 			if (error)
1779 				goto allow_write_and_free_vma;
1780 		}
1781 
1782 		/* ->mmap() can change vma->vm_file, but must guarantee that
1783 		 * vma_link() below can deny write-access if VM_DENYWRITE is set
1784 		 * and map writably if VM_SHARED is set. This usually means the
1785 		 * new file must not have been exposed to user-space, yet.
1786 		 */
1787 		vma->vm_file = get_file(file);
1788 		error = call_mmap(file, vma);
1789 		if (error)
1790 			goto unmap_and_free_vma;
1791 
1792 		/* Can addr have changed??
1793 		 *
1794 		 * Answer: Yes, several device drivers can do it in their
1795 		 *         f_op->mmap method. -DaveM
1796 		 * Bug: If addr is changed, prev, rb_link, rb_parent should
1797 		 *      be updated for vma_link()
1798 		 */
1799 		WARN_ON_ONCE(addr != vma->vm_start);
1800 
1801 		addr = vma->vm_start;
1802 		vm_flags = vma->vm_flags;
1803 	} else if (vm_flags & VM_SHARED) {
1804 		error = shmem_zero_setup(vma);
1805 		if (error)
1806 			goto free_vma;
1807 	} else {
1808 		vma_set_anonymous(vma);
1809 	}
1810 
1811 	vma_link(mm, vma, prev, rb_link, rb_parent);
1812 	/* Once vma denies write, undo our temporary denial count */
1813 	if (file) {
1814 		if (vm_flags & VM_SHARED)
1815 			mapping_unmap_writable(file->f_mapping);
1816 		if (vm_flags & VM_DENYWRITE)
1817 			allow_write_access(file);
1818 	}
1819 	file = vma->vm_file;
1820 out:
1821 	perf_event_mmap(vma);
1822 
1823 	vm_stat_account(mm, vm_flags, len >> PAGE_SHIFT);
1824 	if (vm_flags & VM_LOCKED) {
1825 		if ((vm_flags & VM_SPECIAL) || vma_is_dax(vma) ||
1826 					is_vm_hugetlb_page(vma) ||
1827 					vma == get_gate_vma(current->mm))
1828 			vma->vm_flags &= VM_LOCKED_CLEAR_MASK;
1829 		else
1830 			mm->locked_vm += (len >> PAGE_SHIFT);
1831 	}
1832 
1833 	if (file)
1834 		uprobe_mmap(vma);
1835 
1836 	/*
1837 	 * New (or expanded) vma always get soft dirty status.
1838 	 * Otherwise user-space soft-dirty page tracker won't
1839 	 * be able to distinguish situation when vma area unmapped,
1840 	 * then new mapped in-place (which must be aimed as
1841 	 * a completely new data area).
1842 	 */
1843 	vma->vm_flags |= VM_SOFTDIRTY;
1844 
1845 	vma_set_page_prot(vma);
1846 
1847 	return addr;
1848 
1849 unmap_and_free_vma:
1850 	vma->vm_file = NULL;
1851 	fput(file);
1852 
1853 	/* Undo any partial mapping done by a device driver. */
1854 	unmap_region(mm, vma, prev, vma->vm_start, vma->vm_end);
1855 	charged = 0;
1856 	if (vm_flags & VM_SHARED)
1857 		mapping_unmap_writable(file->f_mapping);
1858 allow_write_and_free_vma:
1859 	if (vm_flags & VM_DENYWRITE)
1860 		allow_write_access(file);
1861 free_vma:
1862 	vm_area_free(vma);
1863 unacct_error:
1864 	if (charged)
1865 		vm_unacct_memory(charged);
1866 	return error;
1867 }
1868 
1869 unsigned long unmapped_area(struct vm_unmapped_area_info *info)
1870 {
1871 	/*
1872 	 * We implement the search by looking for an rbtree node that
1873 	 * immediately follows a suitable gap. That is,
1874 	 * - gap_start = vma->vm_prev->vm_end <= info->high_limit - length;
1875 	 * - gap_end   = vma->vm_start        >= info->low_limit  + length;
1876 	 * - gap_end - gap_start >= length
1877 	 */
1878 
1879 	struct mm_struct *mm = current->mm;
1880 	struct vm_area_struct *vma;
1881 	unsigned long length, low_limit, high_limit, gap_start, gap_end;
1882 
1883 	/* Adjust search length to account for worst case alignment overhead */
1884 	length = info->length + info->align_mask;
1885 	if (length < info->length)
1886 		return -ENOMEM;
1887 
1888 	/* Adjust search limits by the desired length */
1889 	if (info->high_limit < length)
1890 		return -ENOMEM;
1891 	high_limit = info->high_limit - length;
1892 
1893 	if (info->low_limit > high_limit)
1894 		return -ENOMEM;
1895 	low_limit = info->low_limit + length;
1896 
1897 	/* Check if rbtree root looks promising */
1898 	if (RB_EMPTY_ROOT(&mm->mm_rb))
1899 		goto check_highest;
1900 	vma = rb_entry(mm->mm_rb.rb_node, struct vm_area_struct, vm_rb);
1901 	if (vma->rb_subtree_gap < length)
1902 		goto check_highest;
1903 
1904 	while (true) {
1905 		/* Visit left subtree if it looks promising */
1906 		gap_end = vm_start_gap(vma);
1907 		if (gap_end >= low_limit && vma->vm_rb.rb_left) {
1908 			struct vm_area_struct *left =
1909 				rb_entry(vma->vm_rb.rb_left,
1910 					 struct vm_area_struct, vm_rb);
1911 			if (left->rb_subtree_gap >= length) {
1912 				vma = left;
1913 				continue;
1914 			}
1915 		}
1916 
1917 		gap_start = vma->vm_prev ? vm_end_gap(vma->vm_prev) : 0;
1918 check_current:
1919 		/* Check if current node has a suitable gap */
1920 		if (gap_start > high_limit)
1921 			return -ENOMEM;
1922 		if (gap_end >= low_limit &&
1923 		    gap_end > gap_start && gap_end - gap_start >= length)
1924 			goto found;
1925 
1926 		/* Visit right subtree if it looks promising */
1927 		if (vma->vm_rb.rb_right) {
1928 			struct vm_area_struct *right =
1929 				rb_entry(vma->vm_rb.rb_right,
1930 					 struct vm_area_struct, vm_rb);
1931 			if (right->rb_subtree_gap >= length) {
1932 				vma = right;
1933 				continue;
1934 			}
1935 		}
1936 
1937 		/* Go back up the rbtree to find next candidate node */
1938 		while (true) {
1939 			struct rb_node *prev = &vma->vm_rb;
1940 			if (!rb_parent(prev))
1941 				goto check_highest;
1942 			vma = rb_entry(rb_parent(prev),
1943 				       struct vm_area_struct, vm_rb);
1944 			if (prev == vma->vm_rb.rb_left) {
1945 				gap_start = vm_end_gap(vma->vm_prev);
1946 				gap_end = vm_start_gap(vma);
1947 				goto check_current;
1948 			}
1949 		}
1950 	}
1951 
1952 check_highest:
1953 	/* Check highest gap, which does not precede any rbtree node */
1954 	gap_start = mm->highest_vm_end;
1955 	gap_end = ULONG_MAX;  /* Only for VM_BUG_ON below */
1956 	if (gap_start > high_limit)
1957 		return -ENOMEM;
1958 
1959 found:
1960 	/* We found a suitable gap. Clip it with the original low_limit. */
1961 	if (gap_start < info->low_limit)
1962 		gap_start = info->low_limit;
1963 
1964 	/* Adjust gap address to the desired alignment */
1965 	gap_start += (info->align_offset - gap_start) & info->align_mask;
1966 
1967 	VM_BUG_ON(gap_start + info->length > info->high_limit);
1968 	VM_BUG_ON(gap_start + info->length > gap_end);
1969 	return gap_start;
1970 }
1971 
1972 unsigned long unmapped_area_topdown(struct vm_unmapped_area_info *info)
1973 {
1974 	struct mm_struct *mm = current->mm;
1975 	struct vm_area_struct *vma;
1976 	unsigned long length, low_limit, high_limit, gap_start, gap_end;
1977 
1978 	/* Adjust search length to account for worst case alignment overhead */
1979 	length = info->length + info->align_mask;
1980 	if (length < info->length)
1981 		return -ENOMEM;
1982 
1983 	/*
1984 	 * Adjust search limits by the desired length.
1985 	 * See implementation comment at top of unmapped_area().
1986 	 */
1987 	gap_end = info->high_limit;
1988 	if (gap_end < length)
1989 		return -ENOMEM;
1990 	high_limit = gap_end - length;
1991 
1992 	if (info->low_limit > high_limit)
1993 		return -ENOMEM;
1994 	low_limit = info->low_limit + length;
1995 
1996 	/* Check highest gap, which does not precede any rbtree node */
1997 	gap_start = mm->highest_vm_end;
1998 	if (gap_start <= high_limit)
1999 		goto found_highest;
2000 
2001 	/* Check if rbtree root looks promising */
2002 	if (RB_EMPTY_ROOT(&mm->mm_rb))
2003 		return -ENOMEM;
2004 	vma = rb_entry(mm->mm_rb.rb_node, struct vm_area_struct, vm_rb);
2005 	if (vma->rb_subtree_gap < length)
2006 		return -ENOMEM;
2007 
2008 	while (true) {
2009 		/* Visit right subtree if it looks promising */
2010 		gap_start = vma->vm_prev ? vm_end_gap(vma->vm_prev) : 0;
2011 		if (gap_start <= high_limit && vma->vm_rb.rb_right) {
2012 			struct vm_area_struct *right =
2013 				rb_entry(vma->vm_rb.rb_right,
2014 					 struct vm_area_struct, vm_rb);
2015 			if (right->rb_subtree_gap >= length) {
2016 				vma = right;
2017 				continue;
2018 			}
2019 		}
2020 
2021 check_current:
2022 		/* Check if current node has a suitable gap */
2023 		gap_end = vm_start_gap(vma);
2024 		if (gap_end < low_limit)
2025 			return -ENOMEM;
2026 		if (gap_start <= high_limit &&
2027 		    gap_end > gap_start && gap_end - gap_start >= length)
2028 			goto found;
2029 
2030 		/* Visit left subtree if it looks promising */
2031 		if (vma->vm_rb.rb_left) {
2032 			struct vm_area_struct *left =
2033 				rb_entry(vma->vm_rb.rb_left,
2034 					 struct vm_area_struct, vm_rb);
2035 			if (left->rb_subtree_gap >= length) {
2036 				vma = left;
2037 				continue;
2038 			}
2039 		}
2040 
2041 		/* Go back up the rbtree to find next candidate node */
2042 		while (true) {
2043 			struct rb_node *prev = &vma->vm_rb;
2044 			if (!rb_parent(prev))
2045 				return -ENOMEM;
2046 			vma = rb_entry(rb_parent(prev),
2047 				       struct vm_area_struct, vm_rb);
2048 			if (prev == vma->vm_rb.rb_right) {
2049 				gap_start = vma->vm_prev ?
2050 					vm_end_gap(vma->vm_prev) : 0;
2051 				goto check_current;
2052 			}
2053 		}
2054 	}
2055 
2056 found:
2057 	/* We found a suitable gap. Clip it with the original high_limit. */
2058 	if (gap_end > info->high_limit)
2059 		gap_end = info->high_limit;
2060 
2061 found_highest:
2062 	/* Compute highest gap address at the desired alignment */
2063 	gap_end -= info->length;
2064 	gap_end -= (gap_end - info->align_offset) & info->align_mask;
2065 
2066 	VM_BUG_ON(gap_end < info->low_limit);
2067 	VM_BUG_ON(gap_end < gap_start);
2068 	return gap_end;
2069 }
2070 
2071 
2072 #ifndef arch_get_mmap_end
2073 #define arch_get_mmap_end(addr)	(TASK_SIZE)
2074 #endif
2075 
2076 #ifndef arch_get_mmap_base
2077 #define arch_get_mmap_base(addr, base) (base)
2078 #endif
2079 
2080 /* Get an address range which is currently unmapped.
2081  * For shmat() with addr=0.
2082  *
2083  * Ugly calling convention alert:
2084  * Return value with the low bits set means error value,
2085  * ie
2086  *	if (ret & ~PAGE_MASK)
2087  *		error = ret;
2088  *
2089  * This function "knows" that -ENOMEM has the bits set.
2090  */
2091 #ifndef HAVE_ARCH_UNMAPPED_AREA
2092 unsigned long
2093 arch_get_unmapped_area(struct file *filp, unsigned long addr,
2094 		unsigned long len, unsigned long pgoff, unsigned long flags)
2095 {
2096 	struct mm_struct *mm = current->mm;
2097 	struct vm_area_struct *vma, *prev;
2098 	struct vm_unmapped_area_info info;
2099 	const unsigned long mmap_end = arch_get_mmap_end(addr);
2100 
2101 	if (len > mmap_end - mmap_min_addr)
2102 		return -ENOMEM;
2103 
2104 	if (flags & MAP_FIXED)
2105 		return addr;
2106 
2107 	if (addr) {
2108 		addr = PAGE_ALIGN(addr);
2109 		vma = find_vma_prev(mm, addr, &prev);
2110 		if (mmap_end - len >= addr && addr >= mmap_min_addr &&
2111 		    (!vma || addr + len <= vm_start_gap(vma)) &&
2112 		    (!prev || addr >= vm_end_gap(prev)))
2113 			return addr;
2114 	}
2115 
2116 	info.flags = 0;
2117 	info.length = len;
2118 	info.low_limit = mm->mmap_base;
2119 	info.high_limit = mmap_end;
2120 	info.align_mask = 0;
2121 	return vm_unmapped_area(&info);
2122 }
2123 #endif
2124 
2125 /*
2126  * This mmap-allocator allocates new areas top-down from below the
2127  * stack's low limit (the base):
2128  */
2129 #ifndef HAVE_ARCH_UNMAPPED_AREA_TOPDOWN
2130 unsigned long
2131 arch_get_unmapped_area_topdown(struct file *filp, unsigned long addr,
2132 			  unsigned long len, unsigned long pgoff,
2133 			  unsigned long flags)
2134 {
2135 	struct vm_area_struct *vma, *prev;
2136 	struct mm_struct *mm = current->mm;
2137 	struct vm_unmapped_area_info info;
2138 	const unsigned long mmap_end = arch_get_mmap_end(addr);
2139 
2140 	/* requested length too big for entire address space */
2141 	if (len > mmap_end - mmap_min_addr)
2142 		return -ENOMEM;
2143 
2144 	if (flags & MAP_FIXED)
2145 		return addr;
2146 
2147 	/* requesting a specific address */
2148 	if (addr) {
2149 		addr = PAGE_ALIGN(addr);
2150 		vma = find_vma_prev(mm, addr, &prev);
2151 		if (mmap_end - len >= addr && addr >= mmap_min_addr &&
2152 				(!vma || addr + len <= vm_start_gap(vma)) &&
2153 				(!prev || addr >= vm_end_gap(prev)))
2154 			return addr;
2155 	}
2156 
2157 	info.flags = VM_UNMAPPED_AREA_TOPDOWN;
2158 	info.length = len;
2159 	info.low_limit = max(PAGE_SIZE, mmap_min_addr);
2160 	info.high_limit = arch_get_mmap_base(addr, mm->mmap_base);
2161 	info.align_mask = 0;
2162 	addr = vm_unmapped_area(&info);
2163 
2164 	/*
2165 	 * A failed mmap() very likely causes application failure,
2166 	 * so fall back to the bottom-up function here. This scenario
2167 	 * can happen with large stack limits and large mmap()
2168 	 * allocations.
2169 	 */
2170 	if (offset_in_page(addr)) {
2171 		VM_BUG_ON(addr != -ENOMEM);
2172 		info.flags = 0;
2173 		info.low_limit = TASK_UNMAPPED_BASE;
2174 		info.high_limit = mmap_end;
2175 		addr = vm_unmapped_area(&info);
2176 	}
2177 
2178 	return addr;
2179 }
2180 #endif
2181 
2182 unsigned long
2183 get_unmapped_area(struct file *file, unsigned long addr, unsigned long len,
2184 		unsigned long pgoff, unsigned long flags)
2185 {
2186 	unsigned long (*get_area)(struct file *, unsigned long,
2187 				  unsigned long, unsigned long, unsigned long);
2188 
2189 	unsigned long error = arch_mmap_check(addr, len, flags);
2190 	if (error)
2191 		return error;
2192 
2193 	/* Careful about overflows.. */
2194 	if (len > TASK_SIZE)
2195 		return -ENOMEM;
2196 
2197 	get_area = current->mm->get_unmapped_area;
2198 	if (file) {
2199 		if (file->f_op->get_unmapped_area)
2200 			get_area = file->f_op->get_unmapped_area;
2201 	} else if (flags & MAP_SHARED) {
2202 		/*
2203 		 * mmap_region() will call shmem_zero_setup() to create a file,
2204 		 * so use shmem's get_unmapped_area in case it can be huge.
2205 		 * do_mmap_pgoff() will clear pgoff, so match alignment.
2206 		 */
2207 		pgoff = 0;
2208 		get_area = shmem_get_unmapped_area;
2209 	}
2210 
2211 	addr = get_area(file, addr, len, pgoff, flags);
2212 	if (IS_ERR_VALUE(addr))
2213 		return addr;
2214 
2215 	if (addr > TASK_SIZE - len)
2216 		return -ENOMEM;
2217 	if (offset_in_page(addr))
2218 		return -EINVAL;
2219 
2220 	error = security_mmap_addr(addr);
2221 	return error ? error : addr;
2222 }
2223 
2224 EXPORT_SYMBOL(get_unmapped_area);
2225 
2226 /* Look up the first VMA which satisfies  addr < vm_end,  NULL if none. */
2227 struct vm_area_struct *find_vma(struct mm_struct *mm, unsigned long addr)
2228 {
2229 	struct rb_node *rb_node;
2230 	struct vm_area_struct *vma;
2231 
2232 	/* Check the cache first. */
2233 	vma = vmacache_find(mm, addr);
2234 	if (likely(vma))
2235 		return vma;
2236 
2237 	rb_node = mm->mm_rb.rb_node;
2238 
2239 	while (rb_node) {
2240 		struct vm_area_struct *tmp;
2241 
2242 		tmp = rb_entry(rb_node, struct vm_area_struct, vm_rb);
2243 
2244 		if (tmp->vm_end > addr) {
2245 			vma = tmp;
2246 			if (tmp->vm_start <= addr)
2247 				break;
2248 			rb_node = rb_node->rb_left;
2249 		} else
2250 			rb_node = rb_node->rb_right;
2251 	}
2252 
2253 	if (vma)
2254 		vmacache_update(addr, vma);
2255 	return vma;
2256 }
2257 
2258 EXPORT_SYMBOL(find_vma);
2259 
2260 /*
2261  * Same as find_vma, but also return a pointer to the previous VMA in *pprev.
2262  */
2263 struct vm_area_struct *
2264 find_vma_prev(struct mm_struct *mm, unsigned long addr,
2265 			struct vm_area_struct **pprev)
2266 {
2267 	struct vm_area_struct *vma;
2268 
2269 	vma = find_vma(mm, addr);
2270 	if (vma) {
2271 		*pprev = vma->vm_prev;
2272 	} else {
2273 		struct rb_node *rb_node = mm->mm_rb.rb_node;
2274 		*pprev = NULL;
2275 		while (rb_node) {
2276 			*pprev = rb_entry(rb_node, struct vm_area_struct, vm_rb);
2277 			rb_node = rb_node->rb_right;
2278 		}
2279 	}
2280 	return vma;
2281 }
2282 
2283 /*
2284  * Verify that the stack growth is acceptable and
2285  * update accounting. This is shared with both the
2286  * grow-up and grow-down cases.
2287  */
2288 static int acct_stack_growth(struct vm_area_struct *vma,
2289 			     unsigned long size, unsigned long grow)
2290 {
2291 	struct mm_struct *mm = vma->vm_mm;
2292 	unsigned long new_start;
2293 
2294 	/* address space limit tests */
2295 	if (!may_expand_vm(mm, vma->vm_flags, grow))
2296 		return -ENOMEM;
2297 
2298 	/* Stack limit test */
2299 	if (size > rlimit(RLIMIT_STACK))
2300 		return -ENOMEM;
2301 
2302 	/* mlock limit tests */
2303 	if (vma->vm_flags & VM_LOCKED) {
2304 		unsigned long locked;
2305 		unsigned long limit;
2306 		locked = mm->locked_vm + grow;
2307 		limit = rlimit(RLIMIT_MEMLOCK);
2308 		limit >>= PAGE_SHIFT;
2309 		if (locked > limit && !capable(CAP_IPC_LOCK))
2310 			return -ENOMEM;
2311 	}
2312 
2313 	/* Check to ensure the stack will not grow into a hugetlb-only region */
2314 	new_start = (vma->vm_flags & VM_GROWSUP) ? vma->vm_start :
2315 			vma->vm_end - size;
2316 	if (is_hugepage_only_range(vma->vm_mm, new_start, size))
2317 		return -EFAULT;
2318 
2319 	/*
2320 	 * Overcommit..  This must be the final test, as it will
2321 	 * update security statistics.
2322 	 */
2323 	if (security_vm_enough_memory_mm(mm, grow))
2324 		return -ENOMEM;
2325 
2326 	return 0;
2327 }
2328 
2329 #if defined(CONFIG_STACK_GROWSUP) || defined(CONFIG_IA64)
2330 /*
2331  * PA-RISC uses this for its stack; IA64 for its Register Backing Store.
2332  * vma is the last one with address > vma->vm_end.  Have to extend vma.
2333  */
2334 int expand_upwards(struct vm_area_struct *vma, unsigned long address)
2335 {
2336 	struct mm_struct *mm = vma->vm_mm;
2337 	struct vm_area_struct *next;
2338 	unsigned long gap_addr;
2339 	int error = 0;
2340 
2341 	if (!(vma->vm_flags & VM_GROWSUP))
2342 		return -EFAULT;
2343 
2344 	/* Guard against exceeding limits of the address space. */
2345 	address &= PAGE_MASK;
2346 	if (address >= (TASK_SIZE & PAGE_MASK))
2347 		return -ENOMEM;
2348 	address += PAGE_SIZE;
2349 
2350 	/* Enforce stack_guard_gap */
2351 	gap_addr = address + stack_guard_gap;
2352 
2353 	/* Guard against overflow */
2354 	if (gap_addr < address || gap_addr > TASK_SIZE)
2355 		gap_addr = TASK_SIZE;
2356 
2357 	next = vma->vm_next;
2358 	if (next && next->vm_start < gap_addr &&
2359 			(next->vm_flags & (VM_WRITE|VM_READ|VM_EXEC))) {
2360 		if (!(next->vm_flags & VM_GROWSUP))
2361 			return -ENOMEM;
2362 		/* Check that both stack segments have the same anon_vma? */
2363 	}
2364 
2365 	/* We must make sure the anon_vma is allocated. */
2366 	if (unlikely(anon_vma_prepare(vma)))
2367 		return -ENOMEM;
2368 
2369 	/*
2370 	 * vma->vm_start/vm_end cannot change under us because the caller
2371 	 * is required to hold the mmap_sem in read mode.  We need the
2372 	 * anon_vma lock to serialize against concurrent expand_stacks.
2373 	 */
2374 	anon_vma_lock_write(vma->anon_vma);
2375 
2376 	/* Somebody else might have raced and expanded it already */
2377 	if (address > vma->vm_end) {
2378 		unsigned long size, grow;
2379 
2380 		size = address - vma->vm_start;
2381 		grow = (address - vma->vm_end) >> PAGE_SHIFT;
2382 
2383 		error = -ENOMEM;
2384 		if (vma->vm_pgoff + (size >> PAGE_SHIFT) >= vma->vm_pgoff) {
2385 			error = acct_stack_growth(vma, size, grow);
2386 			if (!error) {
2387 				/*
2388 				 * vma_gap_update() doesn't support concurrent
2389 				 * updates, but we only hold a shared mmap_sem
2390 				 * lock here, so we need to protect against
2391 				 * concurrent vma expansions.
2392 				 * anon_vma_lock_write() doesn't help here, as
2393 				 * we don't guarantee that all growable vmas
2394 				 * in a mm share the same root anon vma.
2395 				 * So, we reuse mm->page_table_lock to guard
2396 				 * against concurrent vma expansions.
2397 				 */
2398 				spin_lock(&mm->page_table_lock);
2399 				if (vma->vm_flags & VM_LOCKED)
2400 					mm->locked_vm += grow;
2401 				vm_stat_account(mm, vma->vm_flags, grow);
2402 				anon_vma_interval_tree_pre_update_vma(vma);
2403 				vma->vm_end = address;
2404 				anon_vma_interval_tree_post_update_vma(vma);
2405 				if (vma->vm_next)
2406 					vma_gap_update(vma->vm_next);
2407 				else
2408 					mm->highest_vm_end = vm_end_gap(vma);
2409 				spin_unlock(&mm->page_table_lock);
2410 
2411 				perf_event_mmap(vma);
2412 			}
2413 		}
2414 	}
2415 	anon_vma_unlock_write(vma->anon_vma);
2416 	khugepaged_enter_vma_merge(vma, vma->vm_flags);
2417 	validate_mm(mm);
2418 	return error;
2419 }
2420 #endif /* CONFIG_STACK_GROWSUP || CONFIG_IA64 */
2421 
2422 /*
2423  * vma is the first one with address < vma->vm_start.  Have to extend vma.
2424  */
2425 int expand_downwards(struct vm_area_struct *vma,
2426 				   unsigned long address)
2427 {
2428 	struct mm_struct *mm = vma->vm_mm;
2429 	struct vm_area_struct *prev;
2430 	int error = 0;
2431 
2432 	address &= PAGE_MASK;
2433 	if (address < mmap_min_addr)
2434 		return -EPERM;
2435 
2436 	/* Enforce stack_guard_gap */
2437 	prev = vma->vm_prev;
2438 	/* Check that both stack segments have the same anon_vma? */
2439 	if (prev && !(prev->vm_flags & VM_GROWSDOWN) &&
2440 			(prev->vm_flags & (VM_WRITE|VM_READ|VM_EXEC))) {
2441 		if (address - prev->vm_end < stack_guard_gap)
2442 			return -ENOMEM;
2443 	}
2444 
2445 	/* We must make sure the anon_vma is allocated. */
2446 	if (unlikely(anon_vma_prepare(vma)))
2447 		return -ENOMEM;
2448 
2449 	/*
2450 	 * vma->vm_start/vm_end cannot change under us because the caller
2451 	 * is required to hold the mmap_sem in read mode.  We need the
2452 	 * anon_vma lock to serialize against concurrent expand_stacks.
2453 	 */
2454 	anon_vma_lock_write(vma->anon_vma);
2455 
2456 	/* Somebody else might have raced and expanded it already */
2457 	if (address < vma->vm_start) {
2458 		unsigned long size, grow;
2459 
2460 		size = vma->vm_end - address;
2461 		grow = (vma->vm_start - address) >> PAGE_SHIFT;
2462 
2463 		error = -ENOMEM;
2464 		if (grow <= vma->vm_pgoff) {
2465 			error = acct_stack_growth(vma, size, grow);
2466 			if (!error) {
2467 				/*
2468 				 * vma_gap_update() doesn't support concurrent
2469 				 * updates, but we only hold a shared mmap_sem
2470 				 * lock here, so we need to protect against
2471 				 * concurrent vma expansions.
2472 				 * anon_vma_lock_write() doesn't help here, as
2473 				 * we don't guarantee that all growable vmas
2474 				 * in a mm share the same root anon vma.
2475 				 * So, we reuse mm->page_table_lock to guard
2476 				 * against concurrent vma expansions.
2477 				 */
2478 				spin_lock(&mm->page_table_lock);
2479 				if (vma->vm_flags & VM_LOCKED)
2480 					mm->locked_vm += grow;
2481 				vm_stat_account(mm, vma->vm_flags, grow);
2482 				anon_vma_interval_tree_pre_update_vma(vma);
2483 				vma->vm_start = address;
2484 				vma->vm_pgoff -= grow;
2485 				anon_vma_interval_tree_post_update_vma(vma);
2486 				vma_gap_update(vma);
2487 				spin_unlock(&mm->page_table_lock);
2488 
2489 				perf_event_mmap(vma);
2490 			}
2491 		}
2492 	}
2493 	anon_vma_unlock_write(vma->anon_vma);
2494 	khugepaged_enter_vma_merge(vma, vma->vm_flags);
2495 	validate_mm(mm);
2496 	return error;
2497 }
2498 
2499 /* enforced gap between the expanding stack and other mappings. */
2500 unsigned long stack_guard_gap = 256UL<<PAGE_SHIFT;
2501 
2502 static int __init cmdline_parse_stack_guard_gap(char *p)
2503 {
2504 	unsigned long val;
2505 	char *endptr;
2506 
2507 	val = simple_strtoul(p, &endptr, 10);
2508 	if (!*endptr)
2509 		stack_guard_gap = val << PAGE_SHIFT;
2510 
2511 	return 0;
2512 }
2513 __setup("stack_guard_gap=", cmdline_parse_stack_guard_gap);
2514 
2515 #ifdef CONFIG_STACK_GROWSUP
2516 int expand_stack(struct vm_area_struct *vma, unsigned long address)
2517 {
2518 	return expand_upwards(vma, address);
2519 }
2520 
2521 struct vm_area_struct *
2522 find_extend_vma(struct mm_struct *mm, unsigned long addr)
2523 {
2524 	struct vm_area_struct *vma, *prev;
2525 
2526 	addr &= PAGE_MASK;
2527 	vma = find_vma_prev(mm, addr, &prev);
2528 	if (vma && (vma->vm_start <= addr))
2529 		return vma;
2530 	/* don't alter vm_end if the coredump is running */
2531 	if (!prev || !mmget_still_valid(mm) || expand_stack(prev, addr))
2532 		return NULL;
2533 	if (prev->vm_flags & VM_LOCKED)
2534 		populate_vma_page_range(prev, addr, prev->vm_end, NULL);
2535 	return prev;
2536 }
2537 #else
2538 int expand_stack(struct vm_area_struct *vma, unsigned long address)
2539 {
2540 	return expand_downwards(vma, address);
2541 }
2542 
2543 struct vm_area_struct *
2544 find_extend_vma(struct mm_struct *mm, unsigned long addr)
2545 {
2546 	struct vm_area_struct *vma;
2547 	unsigned long start;
2548 
2549 	addr &= PAGE_MASK;
2550 	vma = find_vma(mm, addr);
2551 	if (!vma)
2552 		return NULL;
2553 	if (vma->vm_start <= addr)
2554 		return vma;
2555 	if (!(vma->vm_flags & VM_GROWSDOWN))
2556 		return NULL;
2557 	/* don't alter vm_start if the coredump is running */
2558 	if (!mmget_still_valid(mm))
2559 		return NULL;
2560 	start = vma->vm_start;
2561 	if (expand_stack(vma, addr))
2562 		return NULL;
2563 	if (vma->vm_flags & VM_LOCKED)
2564 		populate_vma_page_range(vma, addr, start, NULL);
2565 	return vma;
2566 }
2567 #endif
2568 
2569 EXPORT_SYMBOL_GPL(find_extend_vma);
2570 
2571 /*
2572  * Ok - we have the memory areas we should free on the vma list,
2573  * so release them, and do the vma updates.
2574  *
2575  * Called with the mm semaphore held.
2576  */
2577 static void remove_vma_list(struct mm_struct *mm, struct vm_area_struct *vma)
2578 {
2579 	unsigned long nr_accounted = 0;
2580 
2581 	/* Update high watermark before we lower total_vm */
2582 	update_hiwater_vm(mm);
2583 	do {
2584 		long nrpages = vma_pages(vma);
2585 
2586 		if (vma->vm_flags & VM_ACCOUNT)
2587 			nr_accounted += nrpages;
2588 		vm_stat_account(mm, vma->vm_flags, -nrpages);
2589 		vma = remove_vma(vma);
2590 	} while (vma);
2591 	vm_unacct_memory(nr_accounted);
2592 	validate_mm(mm);
2593 }
2594 
2595 /*
2596  * Get rid of page table information in the indicated region.
2597  *
2598  * Called with the mm semaphore held.
2599  */
2600 static void unmap_region(struct mm_struct *mm,
2601 		struct vm_area_struct *vma, struct vm_area_struct *prev,
2602 		unsigned long start, unsigned long end)
2603 {
2604 	struct vm_area_struct *next = prev ? prev->vm_next : mm->mmap;
2605 	struct mmu_gather tlb;
2606 
2607 	lru_add_drain();
2608 	tlb_gather_mmu(&tlb, mm, start, end);
2609 	update_hiwater_rss(mm);
2610 	unmap_vmas(&tlb, vma, start, end);
2611 	free_pgtables(&tlb, vma, prev ? prev->vm_end : FIRST_USER_ADDRESS,
2612 				 next ? next->vm_start : USER_PGTABLES_CEILING);
2613 	tlb_finish_mmu(&tlb, start, end);
2614 }
2615 
2616 /*
2617  * Create a list of vma's touched by the unmap, removing them from the mm's
2618  * vma list as we go..
2619  */
2620 static void
2621 detach_vmas_to_be_unmapped(struct mm_struct *mm, struct vm_area_struct *vma,
2622 	struct vm_area_struct *prev, unsigned long end)
2623 {
2624 	struct vm_area_struct **insertion_point;
2625 	struct vm_area_struct *tail_vma = NULL;
2626 
2627 	insertion_point = (prev ? &prev->vm_next : &mm->mmap);
2628 	vma->vm_prev = NULL;
2629 	do {
2630 		vma_rb_erase(vma, &mm->mm_rb);
2631 		mm->map_count--;
2632 		tail_vma = vma;
2633 		vma = vma->vm_next;
2634 	} while (vma && vma->vm_start < end);
2635 	*insertion_point = vma;
2636 	if (vma) {
2637 		vma->vm_prev = prev;
2638 		vma_gap_update(vma);
2639 	} else
2640 		mm->highest_vm_end = prev ? vm_end_gap(prev) : 0;
2641 	tail_vma->vm_next = NULL;
2642 
2643 	/* Kill the cache */
2644 	vmacache_invalidate(mm);
2645 }
2646 
2647 /*
2648  * __split_vma() bypasses sysctl_max_map_count checking.  We use this where it
2649  * has already been checked or doesn't make sense to fail.
2650  */
2651 int __split_vma(struct mm_struct *mm, struct vm_area_struct *vma,
2652 		unsigned long addr, int new_below)
2653 {
2654 	struct vm_area_struct *new;
2655 	int err;
2656 
2657 	if (vma->vm_ops && vma->vm_ops->split) {
2658 		err = vma->vm_ops->split(vma, addr);
2659 		if (err)
2660 			return err;
2661 	}
2662 
2663 	new = vm_area_dup(vma);
2664 	if (!new)
2665 		return -ENOMEM;
2666 
2667 	if (new_below)
2668 		new->vm_end = addr;
2669 	else {
2670 		new->vm_start = addr;
2671 		new->vm_pgoff += ((addr - vma->vm_start) >> PAGE_SHIFT);
2672 	}
2673 
2674 	err = vma_dup_policy(vma, new);
2675 	if (err)
2676 		goto out_free_vma;
2677 
2678 	err = anon_vma_clone(new, vma);
2679 	if (err)
2680 		goto out_free_mpol;
2681 
2682 	if (new->vm_file)
2683 		get_file(new->vm_file);
2684 
2685 	if (new->vm_ops && new->vm_ops->open)
2686 		new->vm_ops->open(new);
2687 
2688 	if (new_below)
2689 		err = vma_adjust(vma, addr, vma->vm_end, vma->vm_pgoff +
2690 			((addr - new->vm_start) >> PAGE_SHIFT), new);
2691 	else
2692 		err = vma_adjust(vma, vma->vm_start, addr, vma->vm_pgoff, new);
2693 
2694 	/* Success. */
2695 	if (!err)
2696 		return 0;
2697 
2698 	/* Clean everything up if vma_adjust failed. */
2699 	if (new->vm_ops && new->vm_ops->close)
2700 		new->vm_ops->close(new);
2701 	if (new->vm_file)
2702 		fput(new->vm_file);
2703 	unlink_anon_vmas(new);
2704  out_free_mpol:
2705 	mpol_put(vma_policy(new));
2706  out_free_vma:
2707 	vm_area_free(new);
2708 	return err;
2709 }
2710 
2711 /*
2712  * Split a vma into two pieces at address 'addr', a new vma is allocated
2713  * either for the first part or the tail.
2714  */
2715 int split_vma(struct mm_struct *mm, struct vm_area_struct *vma,
2716 	      unsigned long addr, int new_below)
2717 {
2718 	if (mm->map_count >= sysctl_max_map_count)
2719 		return -ENOMEM;
2720 
2721 	return __split_vma(mm, vma, addr, new_below);
2722 }
2723 
2724 /* Munmap is split into 2 main parts -- this part which finds
2725  * what needs doing, and the areas themselves, which do the
2726  * work.  This now handles partial unmappings.
2727  * Jeremy Fitzhardinge <jeremy@goop.org>
2728  */
2729 int __do_munmap(struct mm_struct *mm, unsigned long start, size_t len,
2730 		struct list_head *uf, bool downgrade)
2731 {
2732 	unsigned long end;
2733 	struct vm_area_struct *vma, *prev, *last;
2734 
2735 	if ((offset_in_page(start)) || start > TASK_SIZE || len > TASK_SIZE-start)
2736 		return -EINVAL;
2737 
2738 	len = PAGE_ALIGN(len);
2739 	end = start + len;
2740 	if (len == 0)
2741 		return -EINVAL;
2742 
2743 	/*
2744 	 * arch_unmap() might do unmaps itself.  It must be called
2745 	 * and finish any rbtree manipulation before this code
2746 	 * runs and also starts to manipulate the rbtree.
2747 	 */
2748 	arch_unmap(mm, start, end);
2749 
2750 	/* Find the first overlapping VMA */
2751 	vma = find_vma(mm, start);
2752 	if (!vma)
2753 		return 0;
2754 	prev = vma->vm_prev;
2755 	/* we have  start < vma->vm_end  */
2756 
2757 	/* if it doesn't overlap, we have nothing.. */
2758 	if (vma->vm_start >= end)
2759 		return 0;
2760 
2761 	/*
2762 	 * If we need to split any vma, do it now to save pain later.
2763 	 *
2764 	 * Note: mremap's move_vma VM_ACCOUNT handling assumes a partially
2765 	 * unmapped vm_area_struct will remain in use: so lower split_vma
2766 	 * places tmp vma above, and higher split_vma places tmp vma below.
2767 	 */
2768 	if (start > vma->vm_start) {
2769 		int error;
2770 
2771 		/*
2772 		 * Make sure that map_count on return from munmap() will
2773 		 * not exceed its limit; but let map_count go just above
2774 		 * its limit temporarily, to help free resources as expected.
2775 		 */
2776 		if (end < vma->vm_end && mm->map_count >= sysctl_max_map_count)
2777 			return -ENOMEM;
2778 
2779 		error = __split_vma(mm, vma, start, 0);
2780 		if (error)
2781 			return error;
2782 		prev = vma;
2783 	}
2784 
2785 	/* Does it split the last one? */
2786 	last = find_vma(mm, end);
2787 	if (last && end > last->vm_start) {
2788 		int error = __split_vma(mm, last, end, 1);
2789 		if (error)
2790 			return error;
2791 	}
2792 	vma = prev ? prev->vm_next : mm->mmap;
2793 
2794 	if (unlikely(uf)) {
2795 		/*
2796 		 * If userfaultfd_unmap_prep returns an error the vmas
2797 		 * will remain splitted, but userland will get a
2798 		 * highly unexpected error anyway. This is no
2799 		 * different than the case where the first of the two
2800 		 * __split_vma fails, but we don't undo the first
2801 		 * split, despite we could. This is unlikely enough
2802 		 * failure that it's not worth optimizing it for.
2803 		 */
2804 		int error = userfaultfd_unmap_prep(vma, start, end, uf);
2805 		if (error)
2806 			return error;
2807 	}
2808 
2809 	/*
2810 	 * unlock any mlock()ed ranges before detaching vmas
2811 	 */
2812 	if (mm->locked_vm) {
2813 		struct vm_area_struct *tmp = vma;
2814 		while (tmp && tmp->vm_start < end) {
2815 			if (tmp->vm_flags & VM_LOCKED) {
2816 				mm->locked_vm -= vma_pages(tmp);
2817 				munlock_vma_pages_all(tmp);
2818 			}
2819 
2820 			tmp = tmp->vm_next;
2821 		}
2822 	}
2823 
2824 	/* Detach vmas from rbtree */
2825 	detach_vmas_to_be_unmapped(mm, vma, prev, end);
2826 
2827 	if (downgrade)
2828 		downgrade_write(&mm->mmap_sem);
2829 
2830 	unmap_region(mm, vma, prev, start, end);
2831 
2832 	/* Fix up all other VM information */
2833 	remove_vma_list(mm, vma);
2834 
2835 	return downgrade ? 1 : 0;
2836 }
2837 
2838 int do_munmap(struct mm_struct *mm, unsigned long start, size_t len,
2839 	      struct list_head *uf)
2840 {
2841 	return __do_munmap(mm, start, len, uf, false);
2842 }
2843 
2844 static int __vm_munmap(unsigned long start, size_t len, bool downgrade)
2845 {
2846 	int ret;
2847 	struct mm_struct *mm = current->mm;
2848 	LIST_HEAD(uf);
2849 
2850 	if (down_write_killable(&mm->mmap_sem))
2851 		return -EINTR;
2852 
2853 	ret = __do_munmap(mm, start, len, &uf, downgrade);
2854 	/*
2855 	 * Returning 1 indicates mmap_sem is downgraded.
2856 	 * But 1 is not legal return value of vm_munmap() and munmap(), reset
2857 	 * it to 0 before return.
2858 	 */
2859 	if (ret == 1) {
2860 		up_read(&mm->mmap_sem);
2861 		ret = 0;
2862 	} else
2863 		up_write(&mm->mmap_sem);
2864 
2865 	userfaultfd_unmap_complete(mm, &uf);
2866 	return ret;
2867 }
2868 
2869 int vm_munmap(unsigned long start, size_t len)
2870 {
2871 	return __vm_munmap(start, len, false);
2872 }
2873 EXPORT_SYMBOL(vm_munmap);
2874 
2875 SYSCALL_DEFINE2(munmap, unsigned long, addr, size_t, len)
2876 {
2877 	profile_munmap(addr);
2878 	return __vm_munmap(addr, len, true);
2879 }
2880 
2881 
2882 /*
2883  * Emulation of deprecated remap_file_pages() syscall.
2884  */
2885 SYSCALL_DEFINE5(remap_file_pages, unsigned long, start, unsigned long, size,
2886 		unsigned long, prot, unsigned long, pgoff, unsigned long, flags)
2887 {
2888 
2889 	struct mm_struct *mm = current->mm;
2890 	struct vm_area_struct *vma;
2891 	unsigned long populate = 0;
2892 	unsigned long ret = -EINVAL;
2893 	struct file *file;
2894 
2895 	pr_warn_once("%s (%d) uses deprecated remap_file_pages() syscall. See Documentation/vm/remap_file_pages.rst.\n",
2896 		     current->comm, current->pid);
2897 
2898 	if (prot)
2899 		return ret;
2900 	start = start & PAGE_MASK;
2901 	size = size & PAGE_MASK;
2902 
2903 	if (start + size <= start)
2904 		return ret;
2905 
2906 	/* Does pgoff wrap? */
2907 	if (pgoff + (size >> PAGE_SHIFT) < pgoff)
2908 		return ret;
2909 
2910 	if (down_write_killable(&mm->mmap_sem))
2911 		return -EINTR;
2912 
2913 	vma = find_vma(mm, start);
2914 
2915 	if (!vma || !(vma->vm_flags & VM_SHARED))
2916 		goto out;
2917 
2918 	if (start < vma->vm_start)
2919 		goto out;
2920 
2921 	if (start + size > vma->vm_end) {
2922 		struct vm_area_struct *next;
2923 
2924 		for (next = vma->vm_next; next; next = next->vm_next) {
2925 			/* hole between vmas ? */
2926 			if (next->vm_start != next->vm_prev->vm_end)
2927 				goto out;
2928 
2929 			if (next->vm_file != vma->vm_file)
2930 				goto out;
2931 
2932 			if (next->vm_flags != vma->vm_flags)
2933 				goto out;
2934 
2935 			if (start + size <= next->vm_end)
2936 				break;
2937 		}
2938 
2939 		if (!next)
2940 			goto out;
2941 	}
2942 
2943 	prot |= vma->vm_flags & VM_READ ? PROT_READ : 0;
2944 	prot |= vma->vm_flags & VM_WRITE ? PROT_WRITE : 0;
2945 	prot |= vma->vm_flags & VM_EXEC ? PROT_EXEC : 0;
2946 
2947 	flags &= MAP_NONBLOCK;
2948 	flags |= MAP_SHARED | MAP_FIXED | MAP_POPULATE;
2949 	if (vma->vm_flags & VM_LOCKED) {
2950 		struct vm_area_struct *tmp;
2951 		flags |= MAP_LOCKED;
2952 
2953 		/* drop PG_Mlocked flag for over-mapped range */
2954 		for (tmp = vma; tmp->vm_start >= start + size;
2955 				tmp = tmp->vm_next) {
2956 			/*
2957 			 * Split pmd and munlock page on the border
2958 			 * of the range.
2959 			 */
2960 			vma_adjust_trans_huge(tmp, start, start + size, 0);
2961 
2962 			munlock_vma_pages_range(tmp,
2963 					max(tmp->vm_start, start),
2964 					min(tmp->vm_end, start + size));
2965 		}
2966 	}
2967 
2968 	file = get_file(vma->vm_file);
2969 	ret = do_mmap_pgoff(vma->vm_file, start, size,
2970 			prot, flags, pgoff, &populate, NULL);
2971 	fput(file);
2972 out:
2973 	up_write(&mm->mmap_sem);
2974 	if (populate)
2975 		mm_populate(ret, populate);
2976 	if (!IS_ERR_VALUE(ret))
2977 		ret = 0;
2978 	return ret;
2979 }
2980 
2981 /*
2982  *  this is really a simplified "do_mmap".  it only handles
2983  *  anonymous maps.  eventually we may be able to do some
2984  *  brk-specific accounting here.
2985  */
2986 static int do_brk_flags(unsigned long addr, unsigned long len, unsigned long flags, struct list_head *uf)
2987 {
2988 	struct mm_struct *mm = current->mm;
2989 	struct vm_area_struct *vma, *prev;
2990 	struct rb_node **rb_link, *rb_parent;
2991 	pgoff_t pgoff = addr >> PAGE_SHIFT;
2992 	int error;
2993 
2994 	/* Until we need other flags, refuse anything except VM_EXEC. */
2995 	if ((flags & (~VM_EXEC)) != 0)
2996 		return -EINVAL;
2997 	flags |= VM_DATA_DEFAULT_FLAGS | VM_ACCOUNT | mm->def_flags;
2998 
2999 	error = get_unmapped_area(NULL, addr, len, 0, MAP_FIXED);
3000 	if (offset_in_page(error))
3001 		return error;
3002 
3003 	error = mlock_future_check(mm, mm->def_flags, len);
3004 	if (error)
3005 		return error;
3006 
3007 	/*
3008 	 * Clear old maps.  this also does some error checking for us
3009 	 */
3010 	while (find_vma_links(mm, addr, addr + len, &prev, &rb_link,
3011 			      &rb_parent)) {
3012 		if (do_munmap(mm, addr, len, uf))
3013 			return -ENOMEM;
3014 	}
3015 
3016 	/* Check against address space limits *after* clearing old maps... */
3017 	if (!may_expand_vm(mm, flags, len >> PAGE_SHIFT))
3018 		return -ENOMEM;
3019 
3020 	if (mm->map_count > sysctl_max_map_count)
3021 		return -ENOMEM;
3022 
3023 	if (security_vm_enough_memory_mm(mm, len >> PAGE_SHIFT))
3024 		return -ENOMEM;
3025 
3026 	/* Can we just expand an old private anonymous mapping? */
3027 	vma = vma_merge(mm, prev, addr, addr + len, flags,
3028 			NULL, NULL, pgoff, NULL, NULL_VM_UFFD_CTX);
3029 	if (vma)
3030 		goto out;
3031 
3032 	/*
3033 	 * create a vma struct for an anonymous mapping
3034 	 */
3035 	vma = vm_area_alloc(mm);
3036 	if (!vma) {
3037 		vm_unacct_memory(len >> PAGE_SHIFT);
3038 		return -ENOMEM;
3039 	}
3040 
3041 	vma_set_anonymous(vma);
3042 	vma->vm_start = addr;
3043 	vma->vm_end = addr + len;
3044 	vma->vm_pgoff = pgoff;
3045 	vma->vm_flags = flags;
3046 	vma->vm_page_prot = vm_get_page_prot(flags);
3047 	vma_link(mm, vma, prev, rb_link, rb_parent);
3048 out:
3049 	perf_event_mmap(vma);
3050 	mm->total_vm += len >> PAGE_SHIFT;
3051 	mm->data_vm += len >> PAGE_SHIFT;
3052 	if (flags & VM_LOCKED)
3053 		mm->locked_vm += (len >> PAGE_SHIFT);
3054 	vma->vm_flags |= VM_SOFTDIRTY;
3055 	return 0;
3056 }
3057 
3058 int vm_brk_flags(unsigned long addr, unsigned long request, unsigned long flags)
3059 {
3060 	struct mm_struct *mm = current->mm;
3061 	unsigned long len;
3062 	int ret;
3063 	bool populate;
3064 	LIST_HEAD(uf);
3065 
3066 	len = PAGE_ALIGN(request);
3067 	if (len < request)
3068 		return -ENOMEM;
3069 	if (!len)
3070 		return 0;
3071 
3072 	if (down_write_killable(&mm->mmap_sem))
3073 		return -EINTR;
3074 
3075 	ret = do_brk_flags(addr, len, flags, &uf);
3076 	populate = ((mm->def_flags & VM_LOCKED) != 0);
3077 	up_write(&mm->mmap_sem);
3078 	userfaultfd_unmap_complete(mm, &uf);
3079 	if (populate && !ret)
3080 		mm_populate(addr, len);
3081 	return ret;
3082 }
3083 EXPORT_SYMBOL(vm_brk_flags);
3084 
3085 int vm_brk(unsigned long addr, unsigned long len)
3086 {
3087 	return vm_brk_flags(addr, len, 0);
3088 }
3089 EXPORT_SYMBOL(vm_brk);
3090 
3091 /* Release all mmaps. */
3092 void exit_mmap(struct mm_struct *mm)
3093 {
3094 	struct mmu_gather tlb;
3095 	struct vm_area_struct *vma;
3096 	unsigned long nr_accounted = 0;
3097 
3098 	/* mm's last user has gone, and its about to be pulled down */
3099 	mmu_notifier_release(mm);
3100 
3101 	if (unlikely(mm_is_oom_victim(mm))) {
3102 		/*
3103 		 * Manually reap the mm to free as much memory as possible.
3104 		 * Then, as the oom reaper does, set MMF_OOM_SKIP to disregard
3105 		 * this mm from further consideration.  Taking mm->mmap_sem for
3106 		 * write after setting MMF_OOM_SKIP will guarantee that the oom
3107 		 * reaper will not run on this mm again after mmap_sem is
3108 		 * dropped.
3109 		 *
3110 		 * Nothing can be holding mm->mmap_sem here and the above call
3111 		 * to mmu_notifier_release(mm) ensures mmu notifier callbacks in
3112 		 * __oom_reap_task_mm() will not block.
3113 		 *
3114 		 * This needs to be done before calling munlock_vma_pages_all(),
3115 		 * which clears VM_LOCKED, otherwise the oom reaper cannot
3116 		 * reliably test it.
3117 		 */
3118 		(void)__oom_reap_task_mm(mm);
3119 
3120 		set_bit(MMF_OOM_SKIP, &mm->flags);
3121 		down_write(&mm->mmap_sem);
3122 		up_write(&mm->mmap_sem);
3123 	}
3124 
3125 	if (mm->locked_vm) {
3126 		vma = mm->mmap;
3127 		while (vma) {
3128 			if (vma->vm_flags & VM_LOCKED)
3129 				munlock_vma_pages_all(vma);
3130 			vma = vma->vm_next;
3131 		}
3132 	}
3133 
3134 	arch_exit_mmap(mm);
3135 
3136 	vma = mm->mmap;
3137 	if (!vma)	/* Can happen if dup_mmap() received an OOM */
3138 		return;
3139 
3140 	lru_add_drain();
3141 	flush_cache_mm(mm);
3142 	tlb_gather_mmu(&tlb, mm, 0, -1);
3143 	/* update_hiwater_rss(mm) here? but nobody should be looking */
3144 	/* Use -1 here to ensure all VMAs in the mm are unmapped */
3145 	unmap_vmas(&tlb, vma, 0, -1);
3146 	free_pgtables(&tlb, vma, FIRST_USER_ADDRESS, USER_PGTABLES_CEILING);
3147 	tlb_finish_mmu(&tlb, 0, -1);
3148 
3149 	/*
3150 	 * Walk the list again, actually closing and freeing it,
3151 	 * with preemption enabled, without holding any MM locks.
3152 	 */
3153 	while (vma) {
3154 		if (vma->vm_flags & VM_ACCOUNT)
3155 			nr_accounted += vma_pages(vma);
3156 		vma = remove_vma(vma);
3157 	}
3158 	vm_unacct_memory(nr_accounted);
3159 }
3160 
3161 /* Insert vm structure into process list sorted by address
3162  * and into the inode's i_mmap tree.  If vm_file is non-NULL
3163  * then i_mmap_rwsem is taken here.
3164  */
3165 int insert_vm_struct(struct mm_struct *mm, struct vm_area_struct *vma)
3166 {
3167 	struct vm_area_struct *prev;
3168 	struct rb_node **rb_link, *rb_parent;
3169 
3170 	if (find_vma_links(mm, vma->vm_start, vma->vm_end,
3171 			   &prev, &rb_link, &rb_parent))
3172 		return -ENOMEM;
3173 	if ((vma->vm_flags & VM_ACCOUNT) &&
3174 	     security_vm_enough_memory_mm(mm, vma_pages(vma)))
3175 		return -ENOMEM;
3176 
3177 	/*
3178 	 * The vm_pgoff of a purely anonymous vma should be irrelevant
3179 	 * until its first write fault, when page's anon_vma and index
3180 	 * are set.  But now set the vm_pgoff it will almost certainly
3181 	 * end up with (unless mremap moves it elsewhere before that
3182 	 * first wfault), so /proc/pid/maps tells a consistent story.
3183 	 *
3184 	 * By setting it to reflect the virtual start address of the
3185 	 * vma, merges and splits can happen in a seamless way, just
3186 	 * using the existing file pgoff checks and manipulations.
3187 	 * Similarly in do_mmap_pgoff and in do_brk.
3188 	 */
3189 	if (vma_is_anonymous(vma)) {
3190 		BUG_ON(vma->anon_vma);
3191 		vma->vm_pgoff = vma->vm_start >> PAGE_SHIFT;
3192 	}
3193 
3194 	vma_link(mm, vma, prev, rb_link, rb_parent);
3195 	return 0;
3196 }
3197 
3198 /*
3199  * Copy the vma structure to a new location in the same mm,
3200  * prior to moving page table entries, to effect an mremap move.
3201  */
3202 struct vm_area_struct *copy_vma(struct vm_area_struct **vmap,
3203 	unsigned long addr, unsigned long len, pgoff_t pgoff,
3204 	bool *need_rmap_locks)
3205 {
3206 	struct vm_area_struct *vma = *vmap;
3207 	unsigned long vma_start = vma->vm_start;
3208 	struct mm_struct *mm = vma->vm_mm;
3209 	struct vm_area_struct *new_vma, *prev;
3210 	struct rb_node **rb_link, *rb_parent;
3211 	bool faulted_in_anon_vma = true;
3212 
3213 	/*
3214 	 * If anonymous vma has not yet been faulted, update new pgoff
3215 	 * to match new location, to increase its chance of merging.
3216 	 */
3217 	if (unlikely(vma_is_anonymous(vma) && !vma->anon_vma)) {
3218 		pgoff = addr >> PAGE_SHIFT;
3219 		faulted_in_anon_vma = false;
3220 	}
3221 
3222 	if (find_vma_links(mm, addr, addr + len, &prev, &rb_link, &rb_parent))
3223 		return NULL;	/* should never get here */
3224 	new_vma = vma_merge(mm, prev, addr, addr + len, vma->vm_flags,
3225 			    vma->anon_vma, vma->vm_file, pgoff, vma_policy(vma),
3226 			    vma->vm_userfaultfd_ctx);
3227 	if (new_vma) {
3228 		/*
3229 		 * Source vma may have been merged into new_vma
3230 		 */
3231 		if (unlikely(vma_start >= new_vma->vm_start &&
3232 			     vma_start < new_vma->vm_end)) {
3233 			/*
3234 			 * The only way we can get a vma_merge with
3235 			 * self during an mremap is if the vma hasn't
3236 			 * been faulted in yet and we were allowed to
3237 			 * reset the dst vma->vm_pgoff to the
3238 			 * destination address of the mremap to allow
3239 			 * the merge to happen. mremap must change the
3240 			 * vm_pgoff linearity between src and dst vmas
3241 			 * (in turn preventing a vma_merge) to be
3242 			 * safe. It is only safe to keep the vm_pgoff
3243 			 * linear if there are no pages mapped yet.
3244 			 */
3245 			VM_BUG_ON_VMA(faulted_in_anon_vma, new_vma);
3246 			*vmap = vma = new_vma;
3247 		}
3248 		*need_rmap_locks = (new_vma->vm_pgoff <= vma->vm_pgoff);
3249 	} else {
3250 		new_vma = vm_area_dup(vma);
3251 		if (!new_vma)
3252 			goto out;
3253 		new_vma->vm_start = addr;
3254 		new_vma->vm_end = addr + len;
3255 		new_vma->vm_pgoff = pgoff;
3256 		if (vma_dup_policy(vma, new_vma))
3257 			goto out_free_vma;
3258 		if (anon_vma_clone(new_vma, vma))
3259 			goto out_free_mempol;
3260 		if (new_vma->vm_file)
3261 			get_file(new_vma->vm_file);
3262 		if (new_vma->vm_ops && new_vma->vm_ops->open)
3263 			new_vma->vm_ops->open(new_vma);
3264 		vma_link(mm, new_vma, prev, rb_link, rb_parent);
3265 		*need_rmap_locks = false;
3266 	}
3267 	return new_vma;
3268 
3269 out_free_mempol:
3270 	mpol_put(vma_policy(new_vma));
3271 out_free_vma:
3272 	vm_area_free(new_vma);
3273 out:
3274 	return NULL;
3275 }
3276 
3277 /*
3278  * Return true if the calling process may expand its vm space by the passed
3279  * number of pages
3280  */
3281 bool may_expand_vm(struct mm_struct *mm, vm_flags_t flags, unsigned long npages)
3282 {
3283 	if (mm->total_vm + npages > rlimit(RLIMIT_AS) >> PAGE_SHIFT)
3284 		return false;
3285 
3286 	if (is_data_mapping(flags) &&
3287 	    mm->data_vm + npages > rlimit(RLIMIT_DATA) >> PAGE_SHIFT) {
3288 		/* Workaround for Valgrind */
3289 		if (rlimit(RLIMIT_DATA) == 0 &&
3290 		    mm->data_vm + npages <= rlimit_max(RLIMIT_DATA) >> PAGE_SHIFT)
3291 			return true;
3292 
3293 		pr_warn_once("%s (%d): VmData %lu exceed data ulimit %lu. Update limits%s.\n",
3294 			     current->comm, current->pid,
3295 			     (mm->data_vm + npages) << PAGE_SHIFT,
3296 			     rlimit(RLIMIT_DATA),
3297 			     ignore_rlimit_data ? "" : " or use boot option ignore_rlimit_data");
3298 
3299 		if (!ignore_rlimit_data)
3300 			return false;
3301 	}
3302 
3303 	return true;
3304 }
3305 
3306 void vm_stat_account(struct mm_struct *mm, vm_flags_t flags, long npages)
3307 {
3308 	mm->total_vm += npages;
3309 
3310 	if (is_exec_mapping(flags))
3311 		mm->exec_vm += npages;
3312 	else if (is_stack_mapping(flags))
3313 		mm->stack_vm += npages;
3314 	else if (is_data_mapping(flags))
3315 		mm->data_vm += npages;
3316 }
3317 
3318 static vm_fault_t special_mapping_fault(struct vm_fault *vmf);
3319 
3320 /*
3321  * Having a close hook prevents vma merging regardless of flags.
3322  */
3323 static void special_mapping_close(struct vm_area_struct *vma)
3324 {
3325 }
3326 
3327 static const char *special_mapping_name(struct vm_area_struct *vma)
3328 {
3329 	return ((struct vm_special_mapping *)vma->vm_private_data)->name;
3330 }
3331 
3332 static int special_mapping_mremap(struct vm_area_struct *new_vma)
3333 {
3334 	struct vm_special_mapping *sm = new_vma->vm_private_data;
3335 
3336 	if (WARN_ON_ONCE(current->mm != new_vma->vm_mm))
3337 		return -EFAULT;
3338 
3339 	if (sm->mremap)
3340 		return sm->mremap(sm, new_vma);
3341 
3342 	return 0;
3343 }
3344 
3345 static const struct vm_operations_struct special_mapping_vmops = {
3346 	.close = special_mapping_close,
3347 	.fault = special_mapping_fault,
3348 	.mremap = special_mapping_mremap,
3349 	.name = special_mapping_name,
3350 };
3351 
3352 static const struct vm_operations_struct legacy_special_mapping_vmops = {
3353 	.close = special_mapping_close,
3354 	.fault = special_mapping_fault,
3355 };
3356 
3357 static vm_fault_t special_mapping_fault(struct vm_fault *vmf)
3358 {
3359 	struct vm_area_struct *vma = vmf->vma;
3360 	pgoff_t pgoff;
3361 	struct page **pages;
3362 
3363 	if (vma->vm_ops == &legacy_special_mapping_vmops) {
3364 		pages = vma->vm_private_data;
3365 	} else {
3366 		struct vm_special_mapping *sm = vma->vm_private_data;
3367 
3368 		if (sm->fault)
3369 			return sm->fault(sm, vmf->vma, vmf);
3370 
3371 		pages = sm->pages;
3372 	}
3373 
3374 	for (pgoff = vmf->pgoff; pgoff && *pages; ++pages)
3375 		pgoff--;
3376 
3377 	if (*pages) {
3378 		struct page *page = *pages;
3379 		get_page(page);
3380 		vmf->page = page;
3381 		return 0;
3382 	}
3383 
3384 	return VM_FAULT_SIGBUS;
3385 }
3386 
3387 static struct vm_area_struct *__install_special_mapping(
3388 	struct mm_struct *mm,
3389 	unsigned long addr, unsigned long len,
3390 	unsigned long vm_flags, void *priv,
3391 	const struct vm_operations_struct *ops)
3392 {
3393 	int ret;
3394 	struct vm_area_struct *vma;
3395 
3396 	vma = vm_area_alloc(mm);
3397 	if (unlikely(vma == NULL))
3398 		return ERR_PTR(-ENOMEM);
3399 
3400 	vma->vm_start = addr;
3401 	vma->vm_end = addr + len;
3402 
3403 	vma->vm_flags = vm_flags | mm->def_flags | VM_DONTEXPAND | VM_SOFTDIRTY;
3404 	vma->vm_page_prot = vm_get_page_prot(vma->vm_flags);
3405 
3406 	vma->vm_ops = ops;
3407 	vma->vm_private_data = priv;
3408 
3409 	ret = insert_vm_struct(mm, vma);
3410 	if (ret)
3411 		goto out;
3412 
3413 	vm_stat_account(mm, vma->vm_flags, len >> PAGE_SHIFT);
3414 
3415 	perf_event_mmap(vma);
3416 
3417 	return vma;
3418 
3419 out:
3420 	vm_area_free(vma);
3421 	return ERR_PTR(ret);
3422 }
3423 
3424 bool vma_is_special_mapping(const struct vm_area_struct *vma,
3425 	const struct vm_special_mapping *sm)
3426 {
3427 	return vma->vm_private_data == sm &&
3428 		(vma->vm_ops == &special_mapping_vmops ||
3429 		 vma->vm_ops == &legacy_special_mapping_vmops);
3430 }
3431 
3432 /*
3433  * Called with mm->mmap_sem held for writing.
3434  * Insert a new vma covering the given region, with the given flags.
3435  * Its pages are supplied by the given array of struct page *.
3436  * The array can be shorter than len >> PAGE_SHIFT if it's null-terminated.
3437  * The region past the last page supplied will always produce SIGBUS.
3438  * The array pointer and the pages it points to are assumed to stay alive
3439  * for as long as this mapping might exist.
3440  */
3441 struct vm_area_struct *_install_special_mapping(
3442 	struct mm_struct *mm,
3443 	unsigned long addr, unsigned long len,
3444 	unsigned long vm_flags, const struct vm_special_mapping *spec)
3445 {
3446 	return __install_special_mapping(mm, addr, len, vm_flags, (void *)spec,
3447 					&special_mapping_vmops);
3448 }
3449 
3450 int install_special_mapping(struct mm_struct *mm,
3451 			    unsigned long addr, unsigned long len,
3452 			    unsigned long vm_flags, struct page **pages)
3453 {
3454 	struct vm_area_struct *vma = __install_special_mapping(
3455 		mm, addr, len, vm_flags, (void *)pages,
3456 		&legacy_special_mapping_vmops);
3457 
3458 	return PTR_ERR_OR_ZERO(vma);
3459 }
3460 
3461 static DEFINE_MUTEX(mm_all_locks_mutex);
3462 
3463 static void vm_lock_anon_vma(struct mm_struct *mm, struct anon_vma *anon_vma)
3464 {
3465 	if (!test_bit(0, (unsigned long *) &anon_vma->root->rb_root.rb_root.rb_node)) {
3466 		/*
3467 		 * The LSB of head.next can't change from under us
3468 		 * because we hold the mm_all_locks_mutex.
3469 		 */
3470 		down_write_nest_lock(&anon_vma->root->rwsem, &mm->mmap_sem);
3471 		/*
3472 		 * We can safely modify head.next after taking the
3473 		 * anon_vma->root->rwsem. If some other vma in this mm shares
3474 		 * the same anon_vma we won't take it again.
3475 		 *
3476 		 * No need of atomic instructions here, head.next
3477 		 * can't change from under us thanks to the
3478 		 * anon_vma->root->rwsem.
3479 		 */
3480 		if (__test_and_set_bit(0, (unsigned long *)
3481 				       &anon_vma->root->rb_root.rb_root.rb_node))
3482 			BUG();
3483 	}
3484 }
3485 
3486 static void vm_lock_mapping(struct mm_struct *mm, struct address_space *mapping)
3487 {
3488 	if (!test_bit(AS_MM_ALL_LOCKS, &mapping->flags)) {
3489 		/*
3490 		 * AS_MM_ALL_LOCKS can't change from under us because
3491 		 * we hold the mm_all_locks_mutex.
3492 		 *
3493 		 * Operations on ->flags have to be atomic because
3494 		 * even if AS_MM_ALL_LOCKS is stable thanks to the
3495 		 * mm_all_locks_mutex, there may be other cpus
3496 		 * changing other bitflags in parallel to us.
3497 		 */
3498 		if (test_and_set_bit(AS_MM_ALL_LOCKS, &mapping->flags))
3499 			BUG();
3500 		down_write_nest_lock(&mapping->i_mmap_rwsem, &mm->mmap_sem);
3501 	}
3502 }
3503 
3504 /*
3505  * This operation locks against the VM for all pte/vma/mm related
3506  * operations that could ever happen on a certain mm. This includes
3507  * vmtruncate, try_to_unmap, and all page faults.
3508  *
3509  * The caller must take the mmap_sem in write mode before calling
3510  * mm_take_all_locks(). The caller isn't allowed to release the
3511  * mmap_sem until mm_drop_all_locks() returns.
3512  *
3513  * mmap_sem in write mode is required in order to block all operations
3514  * that could modify pagetables and free pages without need of
3515  * altering the vma layout. It's also needed in write mode to avoid new
3516  * anon_vmas to be associated with existing vmas.
3517  *
3518  * A single task can't take more than one mm_take_all_locks() in a row
3519  * or it would deadlock.
3520  *
3521  * The LSB in anon_vma->rb_root.rb_node and the AS_MM_ALL_LOCKS bitflag in
3522  * mapping->flags avoid to take the same lock twice, if more than one
3523  * vma in this mm is backed by the same anon_vma or address_space.
3524  *
3525  * We take locks in following order, accordingly to comment at beginning
3526  * of mm/rmap.c:
3527  *   - all hugetlbfs_i_mmap_rwsem_key locks (aka mapping->i_mmap_rwsem for
3528  *     hugetlb mapping);
3529  *   - all i_mmap_rwsem locks;
3530  *   - all anon_vma->rwseml
3531  *
3532  * We can take all locks within these types randomly because the VM code
3533  * doesn't nest them and we protected from parallel mm_take_all_locks() by
3534  * mm_all_locks_mutex.
3535  *
3536  * mm_take_all_locks() and mm_drop_all_locks are expensive operations
3537  * that may have to take thousand of locks.
3538  *
3539  * mm_take_all_locks() can fail if it's interrupted by signals.
3540  */
3541 int mm_take_all_locks(struct mm_struct *mm)
3542 {
3543 	struct vm_area_struct *vma;
3544 	struct anon_vma_chain *avc;
3545 
3546 	BUG_ON(down_read_trylock(&mm->mmap_sem));
3547 
3548 	mutex_lock(&mm_all_locks_mutex);
3549 
3550 	for (vma = mm->mmap; vma; vma = vma->vm_next) {
3551 		if (signal_pending(current))
3552 			goto out_unlock;
3553 		if (vma->vm_file && vma->vm_file->f_mapping &&
3554 				is_vm_hugetlb_page(vma))
3555 			vm_lock_mapping(mm, vma->vm_file->f_mapping);
3556 	}
3557 
3558 	for (vma = mm->mmap; vma; vma = vma->vm_next) {
3559 		if (signal_pending(current))
3560 			goto out_unlock;
3561 		if (vma->vm_file && vma->vm_file->f_mapping &&
3562 				!is_vm_hugetlb_page(vma))
3563 			vm_lock_mapping(mm, vma->vm_file->f_mapping);
3564 	}
3565 
3566 	for (vma = mm->mmap; vma; vma = vma->vm_next) {
3567 		if (signal_pending(current))
3568 			goto out_unlock;
3569 		if (vma->anon_vma)
3570 			list_for_each_entry(avc, &vma->anon_vma_chain, same_vma)
3571 				vm_lock_anon_vma(mm, avc->anon_vma);
3572 	}
3573 
3574 	return 0;
3575 
3576 out_unlock:
3577 	mm_drop_all_locks(mm);
3578 	return -EINTR;
3579 }
3580 
3581 static void vm_unlock_anon_vma(struct anon_vma *anon_vma)
3582 {
3583 	if (test_bit(0, (unsigned long *) &anon_vma->root->rb_root.rb_root.rb_node)) {
3584 		/*
3585 		 * The LSB of head.next can't change to 0 from under
3586 		 * us because we hold the mm_all_locks_mutex.
3587 		 *
3588 		 * We must however clear the bitflag before unlocking
3589 		 * the vma so the users using the anon_vma->rb_root will
3590 		 * never see our bitflag.
3591 		 *
3592 		 * No need of atomic instructions here, head.next
3593 		 * can't change from under us until we release the
3594 		 * anon_vma->root->rwsem.
3595 		 */
3596 		if (!__test_and_clear_bit(0, (unsigned long *)
3597 					  &anon_vma->root->rb_root.rb_root.rb_node))
3598 			BUG();
3599 		anon_vma_unlock_write(anon_vma);
3600 	}
3601 }
3602 
3603 static void vm_unlock_mapping(struct address_space *mapping)
3604 {
3605 	if (test_bit(AS_MM_ALL_LOCKS, &mapping->flags)) {
3606 		/*
3607 		 * AS_MM_ALL_LOCKS can't change to 0 from under us
3608 		 * because we hold the mm_all_locks_mutex.
3609 		 */
3610 		i_mmap_unlock_write(mapping);
3611 		if (!test_and_clear_bit(AS_MM_ALL_LOCKS,
3612 					&mapping->flags))
3613 			BUG();
3614 	}
3615 }
3616 
3617 /*
3618  * The mmap_sem cannot be released by the caller until
3619  * mm_drop_all_locks() returns.
3620  */
3621 void mm_drop_all_locks(struct mm_struct *mm)
3622 {
3623 	struct vm_area_struct *vma;
3624 	struct anon_vma_chain *avc;
3625 
3626 	BUG_ON(down_read_trylock(&mm->mmap_sem));
3627 	BUG_ON(!mutex_is_locked(&mm_all_locks_mutex));
3628 
3629 	for (vma = mm->mmap; vma; vma = vma->vm_next) {
3630 		if (vma->anon_vma)
3631 			list_for_each_entry(avc, &vma->anon_vma_chain, same_vma)
3632 				vm_unlock_anon_vma(avc->anon_vma);
3633 		if (vma->vm_file && vma->vm_file->f_mapping)
3634 			vm_unlock_mapping(vma->vm_file->f_mapping);
3635 	}
3636 
3637 	mutex_unlock(&mm_all_locks_mutex);
3638 }
3639 
3640 /*
3641  * initialise the percpu counter for VM
3642  */
3643 void __init mmap_init(void)
3644 {
3645 	int ret;
3646 
3647 	ret = percpu_counter_init(&vm_committed_as, 0, GFP_KERNEL);
3648 	VM_BUG_ON(ret);
3649 }
3650 
3651 /*
3652  * Initialise sysctl_user_reserve_kbytes.
3653  *
3654  * This is intended to prevent a user from starting a single memory hogging
3655  * process, such that they cannot recover (kill the hog) in OVERCOMMIT_NEVER
3656  * mode.
3657  *
3658  * The default value is min(3% of free memory, 128MB)
3659  * 128MB is enough to recover with sshd/login, bash, and top/kill.
3660  */
3661 static int init_user_reserve(void)
3662 {
3663 	unsigned long free_kbytes;
3664 
3665 	free_kbytes = global_zone_page_state(NR_FREE_PAGES) << (PAGE_SHIFT - 10);
3666 
3667 	sysctl_user_reserve_kbytes = min(free_kbytes / 32, 1UL << 17);
3668 	return 0;
3669 }
3670 subsys_initcall(init_user_reserve);
3671 
3672 /*
3673  * Initialise sysctl_admin_reserve_kbytes.
3674  *
3675  * The purpose of sysctl_admin_reserve_kbytes is to allow the sys admin
3676  * to log in and kill a memory hogging process.
3677  *
3678  * Systems with more than 256MB will reserve 8MB, enough to recover
3679  * with sshd, bash, and top in OVERCOMMIT_GUESS. Smaller systems will
3680  * only reserve 3% of free pages by default.
3681  */
3682 static int init_admin_reserve(void)
3683 {
3684 	unsigned long free_kbytes;
3685 
3686 	free_kbytes = global_zone_page_state(NR_FREE_PAGES) << (PAGE_SHIFT - 10);
3687 
3688 	sysctl_admin_reserve_kbytes = min(free_kbytes / 32, 1UL << 13);
3689 	return 0;
3690 }
3691 subsys_initcall(init_admin_reserve);
3692 
3693 /*
3694  * Reinititalise user and admin reserves if memory is added or removed.
3695  *
3696  * The default user reserve max is 128MB, and the default max for the
3697  * admin reserve is 8MB. These are usually, but not always, enough to
3698  * enable recovery from a memory hogging process using login/sshd, a shell,
3699  * and tools like top. It may make sense to increase or even disable the
3700  * reserve depending on the existence of swap or variations in the recovery
3701  * tools. So, the admin may have changed them.
3702  *
3703  * If memory is added and the reserves have been eliminated or increased above
3704  * the default max, then we'll trust the admin.
3705  *
3706  * If memory is removed and there isn't enough free memory, then we
3707  * need to reset the reserves.
3708  *
3709  * Otherwise keep the reserve set by the admin.
3710  */
3711 static int reserve_mem_notifier(struct notifier_block *nb,
3712 			     unsigned long action, void *data)
3713 {
3714 	unsigned long tmp, free_kbytes;
3715 
3716 	switch (action) {
3717 	case MEM_ONLINE:
3718 		/* Default max is 128MB. Leave alone if modified by operator. */
3719 		tmp = sysctl_user_reserve_kbytes;
3720 		if (0 < tmp && tmp < (1UL << 17))
3721 			init_user_reserve();
3722 
3723 		/* Default max is 8MB.  Leave alone if modified by operator. */
3724 		tmp = sysctl_admin_reserve_kbytes;
3725 		if (0 < tmp && tmp < (1UL << 13))
3726 			init_admin_reserve();
3727 
3728 		break;
3729 	case MEM_OFFLINE:
3730 		free_kbytes = global_zone_page_state(NR_FREE_PAGES) << (PAGE_SHIFT - 10);
3731 
3732 		if (sysctl_user_reserve_kbytes > free_kbytes) {
3733 			init_user_reserve();
3734 			pr_info("vm.user_reserve_kbytes reset to %lu\n",
3735 				sysctl_user_reserve_kbytes);
3736 		}
3737 
3738 		if (sysctl_admin_reserve_kbytes > free_kbytes) {
3739 			init_admin_reserve();
3740 			pr_info("vm.admin_reserve_kbytes reset to %lu\n",
3741 				sysctl_admin_reserve_kbytes);
3742 		}
3743 		break;
3744 	default:
3745 		break;
3746 	}
3747 	return NOTIFY_OK;
3748 }
3749 
3750 static struct notifier_block reserve_mem_nb = {
3751 	.notifier_call = reserve_mem_notifier,
3752 };
3753 
3754 static int __meminit init_reserve_notifier(void)
3755 {
3756 	if (register_hotmemory_notifier(&reserve_mem_nb))
3757 		pr_err("Failed registering memory add/remove notifier for admin reserve\n");
3758 
3759 	return 0;
3760 }
3761 subsys_initcall(init_reserve_notifier);
3762