[Devel] [PATCH RHEL7 COMMIT] ms/mm: fix regression in remap_file_pages() emulation

[Kirill Tkhai]

The commit is pushed to "branch-rh7-3.10.0-327.36.1.vz7.18.x-ovz" and will appear at https://src.openvz.org/scm/ovz/vzkernel.git
after rh7-3.10.0-327.36.1.vz7.18.3
------>
commit 7a8d6f2166c61ecf11c4781db28f6d8352533408
Author: Kirill A. Shutemov <kirill.shutemov at linux.intel.com>
Date:   Mon Oct 3 14:46:34 2016 +0000

    ms/mm: fix regression in remap_file_pages() emulation
    
    Grazvydas Ignotas has reported a regression in remap_file_pages()
    emulation.
    
    Testcase:
    	#define _GNU_SOURCE
    	#include <assert.h>
    	#include <stdlib.h>
    	#include <stdio.h>
    	#include <sys/mman.h>
    
    	#define SIZE    (4096 * 3)
    
    	int main(int argc, char **argv)
    	{
    		unsigned long *p;
    		long i;
    
    		p = mmap(NULL, SIZE, PROT_READ | PROT_WRITE,
    				MAP_SHARED | MAP_ANONYMOUS, -1, 0);
    		if (p == MAP_FAILED) {
    			perror("mmap");
    			return -1;
    		}
    
    		for (i = 0; i < SIZE / 4096; i++)
    			p[i * 4096 / sizeof(*p)] = i;
    
    		if (remap_file_pages(p, 4096, 0, 1, 0)) {
    			perror("remap_file_pages");
    			return -1;
    		}
    
    		if (remap_file_pages(p, 4096 * 2, 0, 1, 0)) {
    			perror("remap_file_pages");
    			return -1;
    		}
    
    		assert(p[0] == 1);
    
    		munmap(p, SIZE);
    
    		return 0;
    	}
    
    The second remap_file_pages() fails with -EINVAL.
    
    The reason is that remap_file_pages() emulation assumes that the target
    vma covers whole area we want to over map.  That assumption is broken by
    first remap_file_pages() call: it split the area into two vma.
    
    The solution is to check next adjacent vmas, if they map the same file
    with the same flags.
    
    Fixes: c8d78c1823f4 ("mm: replace remap_file_pages() syscall with emulation")
    Signed-off-by: Kirill A. Shutemov <kirill.shutemov at linux.intel.com>
    Reported-by: Grazvydas Ignotas <notasas at gmail.com>
    Tested-by: Grazvydas Ignotas <notasas at gmail.com>
    Cc: <stable at vger.kernel.org>	[4.0+]
    Signed-off-by: Andrew Morton <akpm at linux-foundation.org>
    Signed-off-by: Linus Torvalds <torvalds at linux-foundation.org>
    
    https://jira.sw.ru/browse/PSBM-52992
    
    (cherry picked from commit 48f7df329474b49d83d0dffec1b6186647f11976)
    Signed-off-by: Andrey Ryabinin <aryabinin at virtuozzo.com>
    Reviewed-by: Cyrill Gorcunov <gorcunov at openvz.org>
---
 mm/mmap.c | 34 +++++++++++++++++++++++++++++-----
 1 file changed, 29 insertions(+), 5 deletions(-)

diff --git a/mm/mmap.c b/mm/mmap.c
index 207a8f9..e8900ee 100644
--- a/mm/mmap.c
+++ b/mm/mmap.c
@@ -2701,12 +2701,29 @@ SYSCALL_DEFINE5(remap_file_pages, unsigned long, start, unsigned long, size,
 	if (!vma || !(vma->vm_flags & VM_SHARED))
 		goto out;
 
-	if (start < vma->vm_start || start + size > vma->vm_end)
+	if (start < vma->vm_start)
 		goto out;
 
-	if (pgoff == linear_page_index(vma, start)) {
-		ret = 0;
-		goto out;
+	if (start + size > vma->vm_end) {
+		struct vm_area_struct *next;
+
+		for (next = vma->vm_next; next; next = next->vm_next) {
+			/* hole between vmas ? */
+			if (next->vm_start != next->vm_prev->vm_end)
+				goto out;
+
+			if (next->vm_file != vma->vm_file)
+				goto out;
+
+			if (next->vm_flags != vma->vm_flags)
+				goto out;
+
+			if (start + size <= next->vm_end)
+				break;
+		}
+
+		if (!next)
+			goto out;
 	}
 
 	prot |= vma->vm_flags & VM_READ ? PROT_READ : 0;
@@ -2716,9 +2733,16 @@ SYSCALL_DEFINE5(remap_file_pages, unsigned long, start, unsigned long, size,
 	flags &= MAP_NONBLOCK;
 	flags |= MAP_SHARED | MAP_FIXED | MAP_POPULATE;
 	if (vma->vm_flags & VM_LOCKED) {
+		struct vm_area_struct *tmp;
 		flags |= MAP_LOCKED;
+
 		/* drop PG_Mlocked flag for over-mapped range */
-		munlock_vma_pages_range(vma, start, start + size);
+		for (tmp = vma; tmp->vm_start >= start + size;
+				tmp = tmp->vm_next) {
+			munlock_vma_pages_range(tmp,
+					max(tmp->vm_start, start),
+					min(tmp->vm_end, start + size));
+		}
 	}
 
 	file = get_file(vma->vm_file);