diff options
| author | David Gibson <david@gibson.dropbear.id.au> | 2006-12-22 09:23:03 +1100 |
|---|---|---|
| committer | Paul Mackerras <paulus@samba.org> | 2007-01-09 17:03:01 +1100 |
| commit | 6aa3e1e9447134ccda8b04b91c4ba8182274a78e (patch) | |
| tree | da637c9a708b93bcacc4f4284fba5cc2190c996f | |
| parent | efa06708fe77190f31bed5c3cb5da49e211240f5 (diff) | |
[POWERPC] Fix bogus BUG_ON() in in hugetlb_get_unmapped_area()
The powerpc specific version of hugetlb_get_unmapped_area() makes some
unwarranted assumptions about what checks have been made to its
parameters by its callers. This will lead to a BUG_ON() if a 32-bit
process attempts to make a hugepage mapping which extends above
TASK_SIZE (4GB).
I'm not sure if these assumptions came about because they were valid
with earlier versions of the get_unmapped_area() path, or if it was
always broken. Nonetheless this patch fixes the logic, and removes
the crash.
Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
Signed-off-by: Paul Mackerras <paulus@samba.org>
| -rw-r--r-- | arch/powerpc/mm/hugetlbpage.c | 8 |
1 files changed, 4 insertions, 4 deletions
diff --git a/arch/powerpc/mm/hugetlbpage.c b/arch/powerpc/mm/hugetlbpage.c index 89c836d5480..1bb20d84108 100644 --- a/arch/powerpc/mm/hugetlbpage.c +++ b/arch/powerpc/mm/hugetlbpage.c @@ -744,7 +744,8 @@ static int htlb_check_hinted_area(unsigned long addr, unsigned long len) struct vm_area_struct *vma; vma = find_vma(current->mm, addr); - if (!vma || ((addr + len) <= vma->vm_start)) + if (TASK_SIZE - len >= addr && + (!vma || ((addr + len) <= vma->vm_start))) return 0; return -ENOMEM; @@ -815,6 +816,8 @@ unsigned long hugetlb_get_unmapped_area(struct file *file, unsigned long addr, return -EINVAL; if (len & ~HPAGE_MASK) return -EINVAL; + if (len > TASK_SIZE) + return -ENOMEM; if (!cpu_has_feature(CPU_FTR_16M_PAGE)) return -EINVAL; @@ -823,9 +826,6 @@ unsigned long hugetlb_get_unmapped_area(struct file *file, unsigned long addr, BUG_ON((addr + len) < addr); if (test_thread_flag(TIF_32BIT)) { - /* Paranoia, caller should have dealt with this */ - BUG_ON((addr + len) > 0x100000000UL); - curareas = current->mm->context.low_htlb_areas; /* First see if we can use the hint address */ |