Hugh Dickins c09f7a7508 mm: fix crashes from mbind() merging vmas ...

commit d05f0cdcbe upstream.

In v2.6.34 commit 9d8cebd4bc ("mm: fix mbind vma merge problem")
introduced vma merging to mbind(), but it should have also changed the
convention of passing start vma from queue_pages_range() (formerly
check_range()) to new_vma_page(): vma merging may have already freed
that structure, resulting in BUG at mm/mempolicy.c:1738 and probably
worse crashes.

Fixes: 9d8cebd4bc ("mm: fix mbind vma merge problem")
Reported-by: Naoya Horiguchi <n-horiguchi@ah.jp.nec.com>
Tested-by: Naoya Horiguchi <n-horiguchi@ah.jp.nec.com>
Signed-off-by: Hugh Dickins <hughd@google.com>
Acked-by: Christoph Lameter <cl@linux.com>
Cc: KOSAKI Motohiro <kosaki.motohiro@jp.fujitsu.com>
Cc: Minchan Kim <minchan.kim@gmail.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

2014-07-09 11:21:32 -07:00

..

backing-dev.c

bdi: avoid oops on device removal

2014-04-03 16:20:49 -07:00

balloon_compaction.c

mm: print more details for bad_page()

2014-01-23 16:36:50 -08:00

bootmem.c

mm/bootmem.c: remove unused local `map'

2013-11-13 12:09:09 +09:00

bounce.c

block: Convert bio_for_each_segment() to bvec_iter

2013-11-23 22:33:49 -08:00

cleancache.c

mm: dump page when hitting a VM_BUG_ON using VM_BUG_ON_PAGE

2014-01-23 16:36:50 -08:00

compaction.c

mm/compaction: make isolate_freepages start at pageblock boundary

2014-05-06 13:04:59 -07:00

debug-pagealloc.c

…

dmapool.c

…

early_ioremap.c

mm: create generic early_ioremap() support

2014-04-07 16:36:15 -07:00

fadvise.c

…

failslab.c

…

filemap_xip.c

seqcount: Add lockdep functionality to seqcount/seqlock structures

2013-11-06 12:40:26 +01:00

filemap.c

mm/filemap.c: avoid always dirtying mapping->flags on O_DIRECT

2014-05-23 09:37:29 -07:00

fremap.c

mm: fix bad rss-counter if remap_file_pages raced migration

2014-03-19 16:21:49 -07:00

frontswap.c

…

highmem.c

…

huge_memory.c

thp: close race between split and zap huge pages

2014-04-18 16:40:09 -07:00

hugetlb_cgroup.c

cgroup: drop const from @buffer of cftype->write_string()

2014-03-19 10:23:54 -04:00

hugetlb.c

hugetlb: fix copy_hugetlb_page_range() to handle migration/hwpoisoned entry

2014-07-09 11:21:28 -07:00

hwpoison-inject.c

mm/hwpoison: add '#' to hwpoison_inject

2014-01-21 16:19:48 -08:00

init-mm.c

…

internal.h

mm/readahead.c: inline ra_submit

2014-04-07 16:35:58 -07:00

interval_tree.c

…

iov_iter.c

take iov_iter stuff to mm/iov_iter.c

2014-04-01 23:19:30 -04:00

Kconfig

hugetlb: restrict hugepage_migration_support() to x86_64

2014-06-30 20:13:54 -07:00

Kconfig.debug

…

kmemcheck.c

…

kmemleak-test.c

…

kmemleak.c

mm: postpone the disabling of kmemleak early logging

2014-05-11 17:55:48 +09:00

ksm.c

mm: close PageTail race

2014-03-04 07:55:47 -08:00

list_lru.c

mm: keep page cache radix tree nodes in check

2014-04-03 16:21:01 -07:00

maccess.c

…

madvise.c

mm: madvise: fix MADV_WILLNEED on shmem swapouts

2014-05-23 09:37:29 -07:00

Makefile

Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs

2014-04-12 14:49:50 -07:00

memblock.c

mm/memblock.c: use PFN_PHYS()

2014-04-07 16:35:58 -07:00

memcontrol.c

memcg: do not hang on OOM when killed by userspace OOM access to memory reserves

2014-06-30 20:13:54 -07:00

memory_hotplug.c

mm/memory_hotplug.c: move register_memory_resource out of the lock_memory_hotplug

2014-01-23 16:36:52 -08:00

memory-failure.c

mm/memory-failure.c: support use of a dedicated thread to handle SIGBUS(BUS_MCEERR_AO)

2014-06-30 20:13:55 -07:00

memory.c

mm/numa: Remove BUG_ON() in __handle_mm_fault()

2014-07-09 11:21:32 -07:00

mempolicy.c

mm: fix crashes from mbind() merging vmas

2014-07-09 11:21:32 -07:00

mempool.c

mempool: add unlikely and likely hints

2014-04-07 16:35:55 -07:00

migrate.c

mm: fix swapops.h:131 bug if remap_file_pages raced migration

2014-03-20 22:09:09 -07:00

mincore.c

mm + fs: prepare for non-page entries in page cache radix trees

2014-04-03 16:21:00 -07:00

mlock.c

mm: try_to_unmap_cluster() should lock_page() before mlocking

2014-04-07 16:35:57 -07:00

mm_init.c

mm: bring back /sys/kernel/mm

2014-01-27 21:02:39 -08:00

mmap.c

mm: per-thread vma caching

2014-04-07 16:35:53 -07:00

mmu_context.c

sched/mm: call finish_arch_post_lock_switch in idle_task_exit and use_mm

2014-02-21 08:50:17 +01:00

mmu_notifier.c

mm: audit/fix non-modular users of module_init in core code

2014-01-23 16:36:52 -08:00

mmzone.c

mm: numa: Change page last {nid,pid} into {cpu,pid}

2013-10-09 14:47:45 +02:00

mprotect.c

mm: move mmu notifier call from change_protection to change_pmd_range

2014-04-07 16:35:50 -07:00

mremap.c

mm, thp: close race between mremap() and split_huge_page()

2014-05-11 17:55:48 +09:00

msync.c

…

nobootmem.c

mm/nobootmem.c: mark function as static

2014-04-03 16:21:02 -07:00

nommu.c

mm: nommu: per-thread vma cache fix

2014-07-09 11:21:28 -07:00

oom_kill.c

mm, oom: base root bonus on current usage

2014-01-30 16:56:56 -08:00

page_alloc.c

mm: page_alloc: fix CMA area initialisation when pageblock > MAX_ORDER

2014-07-09 11:21:30 -07:00

page_cgroup.c

mm/page_cgroup.c: mark functions as static

2014-04-03 16:21:02 -07:00

page_io.c

Merge branch 'for-3.14/core' of git://git.kernel.dk/linux-block

2014-01-30 11:19:05 -08:00

page_isolation.c

mm: memory-hotplug: enable memory hotplug to handle hugepage

2013-09-11 15:57:48 -07:00

page-writeback.c

ext4: fix data integrity sync in ordered mode

2014-06-30 20:13:56 -07:00

pagewalk.c

mm/pagewalk.c: fix walk_page_range() access of wrong PTEs

2013-10-30 14:27:03 -07:00

percpu-km.c

…

percpu-vm.c

…

percpu.c

percpu: make pcpu_alloc_chunk() use pcpu_mem_free() instead of kfree()

2014-04-14 16:18:06 -04:00

pgtable-generic.c

mm: fix TLB flush race between migration, and change_protection_range

2013-12-18 19:04:51 -08:00

process_vm_access.c

Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs

2014-04-12 14:49:50 -07:00

quicklist.c

…

readahead.c

mm/readahead.c: inline ra_submit

2014-04-07 16:35:58 -07:00

rmap.c

mm: fix sleeping function warning from __put_anon_vma

2014-06-30 20:13:55 -07:00

shmem.c

tmpfs: ZERO_RANGE and COLLAPSE_RANGE not currently supported

2014-06-26 15:17:37 -04:00

slab_common.c

slub: use sysfs'es release mechanism for kmem_cache

2014-05-06 13:04:59 -07:00

slab.c

slab: fix oops when reading /proc/slab_allocators

2014-06-26 15:17:37 -04:00

slab.h

slub: use sysfs'es release mechanism for kmem_cache

2014-05-06 13:04:59 -07:00

slob.c

mm: slab/slub: use page->list consistently instead of page->lru

2014-04-11 10:06:06 +03:00

slub.c

slub: use sysfs'es release mechanism for kmem_cache

2014-05-06 13:04:59 -07:00

sparse-vmemmap.c

mm/sparse: use memblock apis for early memory allocations

2014-01-21 16:19:47 -08:00

sparse.c

mm: use macros from compiler.h instead of __attribute__((...))

2014-04-07 16:35:54 -07:00

swap_state.c

swap: add a simple detector for inappropriate swapin readahead

2014-02-06 13:48:51 -08:00

swap.c

mm: thrash detection-based file cache sizing

2014-04-03 16:21:01 -07:00

swapfile.c

mm/swap: fix race on swap_info reuse between swapoff and swapon

2014-02-06 13:48:51 -08:00

truncate.c

mm: filemap: update find_get_pages_tag() to deal with shadow entries

2014-05-06 13:04:59 -07:00

util.c

nick kvfree() from apparmor

2014-05-06 14:02:53 -04:00

vmacache.c

mm: don't pointlessly use BUG_ON() for sanity check

2014-04-28 14:24:09 -07:00

vmalloc.c

mm/vmalloc.c: enhance vm_map_ram() comment

2014-04-07 16:35:55 -07:00

vmpressure.c

arm, pm, vmpressure: add missing slab.h includes

2014-02-03 13:24:01 -05:00

vmscan.c

mm: vmscan: clear kswapd's special reclaim powers before exiting

2014-06-30 20:13:55 -07:00

vmstat.c

Merge tag 'cpu-hotplug-3.15-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm

2014-04-07 14:55:46 -07:00

workingset.c

mm: keep page cache radix tree nodes in check

2014-04-03 16:21:01 -07:00

zbud.c

mm/zbud: fix some trivial typos in comments

2013-09-11 15:57:35 -07:00

zsmalloc.c

zsmalloc: Fix CPU hotplug callback registration

2014-03-20 13:43:45 +01:00

zswap.c

Merge branch 'akpm' (incoming from Andrew)

2014-04-07 16:38:06 -07:00