]>
Commit | Line | Data |
---|---|---|
b2441318 | 1 | // SPDX-License-Identifier: GPL-2.0 |
1da177e4 LT |
2 | /* |
3 | * mm/mremap.c | |
4 | * | |
5 | * (C) Copyright 1996 Linus Torvalds | |
6 | * | |
046c6884 | 7 | * Address space accounting code <[email protected]> |
1da177e4 LT |
8 | * (C) Copyright 2002 Red Hat Inc, All Rights Reserved |
9 | */ | |
10 | ||
11 | #include <linux/mm.h> | |
ca3d76b0 | 12 | #include <linux/mm_inline.h> |
1da177e4 | 13 | #include <linux/hugetlb.h> |
1da177e4 | 14 | #include <linux/shm.h> |
1ff82995 | 15 | #include <linux/ksm.h> |
1da177e4 LT |
16 | #include <linux/mman.h> |
17 | #include <linux/swap.h> | |
c59ede7b | 18 | #include <linux/capability.h> |
1da177e4 | 19 | #include <linux/fs.h> |
6dec97dc | 20 | #include <linux/swapops.h> |
1da177e4 LT |
21 | #include <linux/highmem.h> |
22 | #include <linux/security.h> | |
23 | #include <linux/syscalls.h> | |
cddb8a5c | 24 | #include <linux/mmu_notifier.h> |
2581d202 | 25 | #include <linux/uaccess.h> |
72f87654 | 26 | #include <linux/userfaultfd_k.h> |
ca3d76b0 | 27 | #include <linux/mempolicy.h> |
1da177e4 | 28 | |
1da177e4 | 29 | #include <asm/cacheflush.h> |
3bbda69c | 30 | #include <asm/tlb.h> |
0881ace2 | 31 | #include <asm/pgalloc.h> |
1da177e4 | 32 | |
ba470de4 RR |
33 | #include "internal.h" |
34 | ||
c49dd340 | 35 | static pud_t *get_old_pud(struct mm_struct *mm, unsigned long addr) |
1da177e4 LT |
36 | { |
37 | pgd_t *pgd; | |
c2febafc | 38 | p4d_t *p4d; |
1da177e4 | 39 | pud_t *pud; |
1da177e4 LT |
40 | |
41 | pgd = pgd_offset(mm, addr); | |
42 | if (pgd_none_or_clear_bad(pgd)) | |
43 | return NULL; | |
44 | ||
c2febafc KS |
45 | p4d = p4d_offset(pgd, addr); |
46 | if (p4d_none_or_clear_bad(p4d)) | |
47 | return NULL; | |
48 | ||
49 | pud = pud_offset(p4d, addr); | |
1da177e4 LT |
50 | if (pud_none_or_clear_bad(pud)) |
51 | return NULL; | |
52 | ||
c49dd340 KS |
53 | return pud; |
54 | } | |
55 | ||
56 | static pmd_t *get_old_pmd(struct mm_struct *mm, unsigned long addr) | |
57 | { | |
58 | pud_t *pud; | |
59 | pmd_t *pmd; | |
60 | ||
61 | pud = get_old_pud(mm, addr); | |
62 | if (!pud) | |
63 | return NULL; | |
64 | ||
1da177e4 | 65 | pmd = pmd_offset(pud, addr); |
37a1c49a | 66 | if (pmd_none(*pmd)) |
1da177e4 LT |
67 | return NULL; |
68 | ||
7be7a546 | 69 | return pmd; |
1da177e4 LT |
70 | } |
71 | ||
c49dd340 | 72 | static pud_t *alloc_new_pud(struct mm_struct *mm, struct vm_area_struct *vma, |
8ac1f832 | 73 | unsigned long addr) |
1da177e4 LT |
74 | { |
75 | pgd_t *pgd; | |
c2febafc | 76 | p4d_t *p4d; |
1da177e4 LT |
77 | |
78 | pgd = pgd_offset(mm, addr); | |
c2febafc KS |
79 | p4d = p4d_alloc(mm, pgd, addr); |
80 | if (!p4d) | |
81 | return NULL; | |
c49dd340 KS |
82 | |
83 | return pud_alloc(mm, p4d, addr); | |
84 | } | |
85 | ||
86 | static pmd_t *alloc_new_pmd(struct mm_struct *mm, struct vm_area_struct *vma, | |
87 | unsigned long addr) | |
88 | { | |
89 | pud_t *pud; | |
90 | pmd_t *pmd; | |
91 | ||
92 | pud = alloc_new_pud(mm, vma, addr); | |
1da177e4 | 93 | if (!pud) |
c74df32c | 94 | return NULL; |
7be7a546 | 95 | |
1da177e4 | 96 | pmd = pmd_alloc(mm, pud, addr); |
57a8f0cd | 97 | if (!pmd) |
c74df32c | 98 | return NULL; |
7be7a546 | 99 | |
8ac1f832 | 100 | VM_BUG_ON(pmd_trans_huge(*pmd)); |
c74df32c | 101 | |
7be7a546 | 102 | return pmd; |
1da177e4 LT |
103 | } |
104 | ||
1d069b7d HD |
105 | static void take_rmap_locks(struct vm_area_struct *vma) |
106 | { | |
107 | if (vma->vm_file) | |
108 | i_mmap_lock_write(vma->vm_file->f_mapping); | |
109 | if (vma->anon_vma) | |
110 | anon_vma_lock_write(vma->anon_vma); | |
111 | } | |
112 | ||
113 | static void drop_rmap_locks(struct vm_area_struct *vma) | |
114 | { | |
115 | if (vma->anon_vma) | |
116 | anon_vma_unlock_write(vma->anon_vma); | |
117 | if (vma->vm_file) | |
118 | i_mmap_unlock_write(vma->vm_file->f_mapping); | |
119 | } | |
120 | ||
6dec97dc CG |
121 | static pte_t move_soft_dirty_pte(pte_t pte) |
122 | { | |
123 | /* | |
124 | * Set soft dirty bit so we can notice | |
125 | * in userspace the ptes were moved. | |
126 | */ | |
127 | #ifdef CONFIG_MEM_SOFT_DIRTY | |
128 | if (pte_present(pte)) | |
129 | pte = pte_mksoft_dirty(pte); | |
130 | else if (is_swap_pte(pte)) | |
131 | pte = pte_swp_mksoft_dirty(pte); | |
6dec97dc CG |
132 | #endif |
133 | return pte; | |
134 | } | |
135 | ||
a5be621e | 136 | static int move_ptes(struct vm_area_struct *vma, pmd_t *old_pmd, |
7be7a546 HD |
137 | unsigned long old_addr, unsigned long old_end, |
138 | struct vm_area_struct *new_vma, pmd_t *new_pmd, | |
eb66ae03 | 139 | unsigned long new_addr, bool need_rmap_locks) |
1da177e4 | 140 | { |
1da177e4 | 141 | struct mm_struct *mm = vma->vm_mm; |
7be7a546 | 142 | pte_t *old_pte, *new_pte, pte; |
4c21e2f2 | 143 | spinlock_t *old_ptl, *new_ptl; |
5d190420 AL |
144 | bool force_flush = false; |
145 | unsigned long len = old_end - old_addr; | |
a5be621e | 146 | int err = 0; |
1da177e4 | 147 | |
38a76013 | 148 | /* |
c8c06efa | 149 | * When need_rmap_locks is true, we take the i_mmap_rwsem and anon_vma |
38a76013 ML |
150 | * locks to ensure that rmap will always observe either the old or the |
151 | * new ptes. This is the easiest way to avoid races with | |
152 | * truncate_pagecache(), page migration, etc... | |
153 | * | |
154 | * When need_rmap_locks is false, we use other ways to avoid | |
155 | * such races: | |
156 | * | |
157 | * - During exec() shift_arg_pages(), we use a specially tagged vma | |
222100ee | 158 | * which rmap call sites look for using vma_is_temporary_stack(). |
38a76013 ML |
159 | * |
160 | * - During mremap(), new_vma is often known to be placed after vma | |
161 | * in rmap traversal order. This ensures rmap will always observe | |
162 | * either the old pte, or the new pte, or both (the page table locks | |
163 | * serialize access to individual ptes, but only rmap traversal | |
164 | * order guarantees that we won't miss both the old and new ptes). | |
165 | */ | |
1d069b7d HD |
166 | if (need_rmap_locks) |
167 | take_rmap_locks(vma); | |
1da177e4 | 168 | |
4c21e2f2 HD |
169 | /* |
170 | * We don't have to worry about the ordering of src and dst | |
c1e8d7c6 | 171 | * pte locks because exclusive mmap_lock prevents deadlock. |
4c21e2f2 | 172 | */ |
c74df32c | 173 | old_pte = pte_offset_map_lock(mm, old_pmd, old_addr, &old_ptl); |
a5be621e HD |
174 | if (!old_pte) { |
175 | err = -EAGAIN; | |
176 | goto out; | |
177 | } | |
178 | new_pte = pte_offset_map_nolock(mm, new_pmd, new_addr, &new_ptl); | |
179 | if (!new_pte) { | |
180 | pte_unmap_unlock(old_pte, old_ptl); | |
181 | err = -EAGAIN; | |
182 | goto out; | |
183 | } | |
4c21e2f2 | 184 | if (new_ptl != old_ptl) |
f20dc5f7 | 185 | spin_lock_nested(new_ptl, SINGLE_DEPTH_NESTING); |
3ea27719 | 186 | flush_tlb_batched_pending(vma->vm_mm); |
6606c3e0 | 187 | arch_enter_lazy_mmu_mode(); |
7be7a546 HD |
188 | |
189 | for (; old_addr < old_end; old_pte++, old_addr += PAGE_SIZE, | |
190 | new_pte++, new_addr += PAGE_SIZE) { | |
c33c7948 | 191 | if (pte_none(ptep_get(old_pte))) |
7be7a546 | 192 | continue; |
5d190420 | 193 | |
a2ce2666 | 194 | pte = ptep_get_and_clear(mm, old_addr, old_pte); |
5d190420 | 195 | /* |
eb66ae03 | 196 | * If we are remapping a valid PTE, make sure |
a2ce2666 | 197 | * to flush TLB before we drop the PTL for the |
eb66ae03 | 198 | * PTE. |
a2ce2666 | 199 | * |
eb66ae03 LT |
200 | * NOTE! Both old and new PTL matter: the old one |
201 | * for racing with page_mkclean(), the new one to | |
202 | * make sure the physical page stays valid until | |
203 | * the TLB entry for the old mapping has been | |
204 | * flushed. | |
5d190420 | 205 | */ |
eb66ae03 | 206 | if (pte_present(pte)) |
5d190420 | 207 | force_flush = true; |
7be7a546 | 208 | pte = move_pte(pte, new_vma->vm_page_prot, old_addr, new_addr); |
6dec97dc CG |
209 | pte = move_soft_dirty_pte(pte); |
210 | set_pte_at(mm, new_addr, new_pte, pte); | |
1da177e4 | 211 | } |
7be7a546 | 212 | |
6606c3e0 | 213 | arch_leave_lazy_mmu_mode(); |
eb66ae03 LT |
214 | if (force_flush) |
215 | flush_tlb_range(vma, old_end - len, old_end); | |
4c21e2f2 HD |
216 | if (new_ptl != old_ptl) |
217 | spin_unlock(new_ptl); | |
ece0e2b6 | 218 | pte_unmap(new_pte - 1); |
c74df32c | 219 | pte_unmap_unlock(old_pte - 1, old_ptl); |
a5be621e | 220 | out: |
1d069b7d HD |
221 | if (need_rmap_locks) |
222 | drop_rmap_locks(vma); | |
a5be621e | 223 | return err; |
1da177e4 LT |
224 | } |
225 | ||
3bbda69c AK |
226 | #ifndef arch_supports_page_table_move |
227 | #define arch_supports_page_table_move arch_supports_page_table_move | |
228 | static inline bool arch_supports_page_table_move(void) | |
229 | { | |
230 | return IS_ENABLED(CONFIG_HAVE_MOVE_PMD) || | |
231 | IS_ENABLED(CONFIG_HAVE_MOVE_PUD); | |
232 | } | |
233 | #endif | |
234 | ||
2c91bd4a JFG |
235 | #ifdef CONFIG_HAVE_MOVE_PMD |
236 | static bool move_normal_pmd(struct vm_area_struct *vma, unsigned long old_addr, | |
b8aa9d9d | 237 | unsigned long new_addr, pmd_t *old_pmd, pmd_t *new_pmd) |
2c91bd4a JFG |
238 | { |
239 | spinlock_t *old_ptl, *new_ptl; | |
240 | struct mm_struct *mm = vma->vm_mm; | |
241 | pmd_t pmd; | |
242 | ||
3bbda69c AK |
243 | if (!arch_supports_page_table_move()) |
244 | return false; | |
2c91bd4a JFG |
245 | /* |
246 | * The destination pmd shouldn't be established, free_pgtables() | |
f81fdd0c LT |
247 | * should have released it. |
248 | * | |
249 | * However, there's a case during execve() where we use mremap | |
250 | * to move the initial stack, and in that case the target area | |
251 | * may overlap the source area (always moving down). | |
252 | * | |
253 | * If everything is PMD-aligned, that works fine, as moving | |
254 | * each pmd down will clear the source pmd. But if we first | |
255 | * have a few 4kB-only pages that get moved down, and then | |
256 | * hit the "now the rest is PMD-aligned, let's do everything | |
257 | * one pmd at a time", we will still have the old (now empty | |
258 | * of any 4kB pages, but still there) PMD in the page table | |
259 | * tree. | |
260 | * | |
261 | * Warn on it once - because we really should try to figure | |
262 | * out how to do this better - but then say "I won't move | |
263 | * this pmd". | |
264 | * | |
265 | * One alternative might be to just unmap the target pmd at | |
266 | * this point, and verify that it really is empty. We'll see. | |
2c91bd4a | 267 | */ |
f81fdd0c | 268 | if (WARN_ON_ONCE(!pmd_none(*new_pmd))) |
2c91bd4a JFG |
269 | return false; |
270 | ||
271 | /* | |
272 | * We don't have to worry about the ordering of src and dst | |
c1e8d7c6 | 273 | * ptlocks because exclusive mmap_lock prevents deadlock. |
2c91bd4a JFG |
274 | */ |
275 | old_ptl = pmd_lock(vma->vm_mm, old_pmd); | |
276 | new_ptl = pmd_lockptr(mm, new_pmd); | |
277 | if (new_ptl != old_ptl) | |
278 | spin_lock_nested(new_ptl, SINGLE_DEPTH_NESTING); | |
279 | ||
280 | /* Clear the pmd */ | |
281 | pmd = *old_pmd; | |
282 | pmd_clear(old_pmd); | |
283 | ||
284 | VM_BUG_ON(!pmd_none(*new_pmd)); | |
285 | ||
0881ace2 | 286 | pmd_populate(mm, new_pmd, pmd_pgtable(pmd)); |
2c91bd4a JFG |
287 | flush_tlb_range(vma, old_addr, old_addr + PMD_SIZE); |
288 | if (new_ptl != old_ptl) | |
289 | spin_unlock(new_ptl); | |
290 | spin_unlock(old_ptl); | |
291 | ||
292 | return true; | |
293 | } | |
c49dd340 KS |
294 | #else |
295 | static inline bool move_normal_pmd(struct vm_area_struct *vma, | |
296 | unsigned long old_addr, unsigned long new_addr, pmd_t *old_pmd, | |
297 | pmd_t *new_pmd) | |
298 | { | |
299 | return false; | |
300 | } | |
301 | #endif | |
302 | ||
d6655dff | 303 | #if CONFIG_PGTABLE_LEVELS > 2 && defined(CONFIG_HAVE_MOVE_PUD) |
c49dd340 KS |
304 | static bool move_normal_pud(struct vm_area_struct *vma, unsigned long old_addr, |
305 | unsigned long new_addr, pud_t *old_pud, pud_t *new_pud) | |
306 | { | |
307 | spinlock_t *old_ptl, *new_ptl; | |
308 | struct mm_struct *mm = vma->vm_mm; | |
309 | pud_t pud; | |
310 | ||
3bbda69c AK |
311 | if (!arch_supports_page_table_move()) |
312 | return false; | |
c49dd340 KS |
313 | /* |
314 | * The destination pud shouldn't be established, free_pgtables() | |
315 | * should have released it. | |
316 | */ | |
317 | if (WARN_ON_ONCE(!pud_none(*new_pud))) | |
318 | return false; | |
319 | ||
320 | /* | |
321 | * We don't have to worry about the ordering of src and dst | |
322 | * ptlocks because exclusive mmap_lock prevents deadlock. | |
323 | */ | |
324 | old_ptl = pud_lock(vma->vm_mm, old_pud); | |
325 | new_ptl = pud_lockptr(mm, new_pud); | |
326 | if (new_ptl != old_ptl) | |
327 | spin_lock_nested(new_ptl, SINGLE_DEPTH_NESTING); | |
328 | ||
329 | /* Clear the pud */ | |
330 | pud = *old_pud; | |
331 | pud_clear(old_pud); | |
332 | ||
333 | VM_BUG_ON(!pud_none(*new_pud)); | |
334 | ||
0881ace2 | 335 | pud_populate(mm, new_pud, pud_pgtable(pud)); |
c49dd340 KS |
336 | flush_tlb_range(vma, old_addr, old_addr + PUD_SIZE); |
337 | if (new_ptl != old_ptl) | |
338 | spin_unlock(new_ptl); | |
339 | spin_unlock(old_ptl); | |
340 | ||
341 | return true; | |
342 | } | |
343 | #else | |
344 | static inline bool move_normal_pud(struct vm_area_struct *vma, | |
345 | unsigned long old_addr, unsigned long new_addr, pud_t *old_pud, | |
346 | pud_t *new_pud) | |
347 | { | |
348 | return false; | |
349 | } | |
2c91bd4a JFG |
350 | #endif |
351 | ||
54a948a1 | 352 | #if defined(CONFIG_TRANSPARENT_HUGEPAGE) && defined(CONFIG_HAVE_ARCH_TRANSPARENT_HUGEPAGE_PUD) |
7d846db7 AK |
353 | static bool move_huge_pud(struct vm_area_struct *vma, unsigned long old_addr, |
354 | unsigned long new_addr, pud_t *old_pud, pud_t *new_pud) | |
355 | { | |
356 | spinlock_t *old_ptl, *new_ptl; | |
357 | struct mm_struct *mm = vma->vm_mm; | |
358 | pud_t pud; | |
359 | ||
360 | /* | |
361 | * The destination pud shouldn't be established, free_pgtables() | |
362 | * should have released it. | |
363 | */ | |
364 | if (WARN_ON_ONCE(!pud_none(*new_pud))) | |
365 | return false; | |
366 | ||
367 | /* | |
368 | * We don't have to worry about the ordering of src and dst | |
369 | * ptlocks because exclusive mmap_lock prevents deadlock. | |
370 | */ | |
371 | old_ptl = pud_lock(vma->vm_mm, old_pud); | |
372 | new_ptl = pud_lockptr(mm, new_pud); | |
373 | if (new_ptl != old_ptl) | |
374 | spin_lock_nested(new_ptl, SINGLE_DEPTH_NESTING); | |
375 | ||
376 | /* Clear the pud */ | |
377 | pud = *old_pud; | |
378 | pud_clear(old_pud); | |
379 | ||
380 | VM_BUG_ON(!pud_none(*new_pud)); | |
381 | ||
382 | /* Set the new pud */ | |
383 | /* mark soft_ditry when we add pud level soft dirty support */ | |
384 | set_pud_at(mm, new_addr, new_pud, pud); | |
385 | flush_pud_tlb_range(vma, old_addr, old_addr + HPAGE_PUD_SIZE); | |
386 | if (new_ptl != old_ptl) | |
387 | spin_unlock(new_ptl); | |
388 | spin_unlock(old_ptl); | |
389 | ||
390 | return true; | |
391 | } | |
392 | #else | |
393 | static bool move_huge_pud(struct vm_area_struct *vma, unsigned long old_addr, | |
394 | unsigned long new_addr, pud_t *old_pud, pud_t *new_pud) | |
395 | { | |
396 | WARN_ON_ONCE(1); | |
397 | return false; | |
398 | ||
399 | } | |
400 | #endif | |
401 | ||
c49dd340 KS |
402 | enum pgt_entry { |
403 | NORMAL_PMD, | |
404 | HPAGE_PMD, | |
405 | NORMAL_PUD, | |
7d846db7 | 406 | HPAGE_PUD, |
c49dd340 KS |
407 | }; |
408 | ||
409 | /* | |
410 | * Returns an extent of the corresponding size for the pgt_entry specified if | |
411 | * valid. Else returns a smaller extent bounded by the end of the source and | |
412 | * destination pgt_entry. | |
413 | */ | |
a30a2909 AB |
414 | static __always_inline unsigned long get_extent(enum pgt_entry entry, |
415 | unsigned long old_addr, unsigned long old_end, | |
416 | unsigned long new_addr) | |
c49dd340 KS |
417 | { |
418 | unsigned long next, extent, mask, size; | |
419 | ||
420 | switch (entry) { | |
421 | case HPAGE_PMD: | |
422 | case NORMAL_PMD: | |
423 | mask = PMD_MASK; | |
424 | size = PMD_SIZE; | |
425 | break; | |
7d846db7 | 426 | case HPAGE_PUD: |
c49dd340 KS |
427 | case NORMAL_PUD: |
428 | mask = PUD_MASK; | |
429 | size = PUD_SIZE; | |
430 | break; | |
431 | default: | |
432 | BUILD_BUG(); | |
433 | break; | |
434 | } | |
435 | ||
436 | next = (old_addr + size) & mask; | |
437 | /* even if next overflowed, extent below will be ok */ | |
e05986ee KS |
438 | extent = next - old_addr; |
439 | if (extent > old_end - old_addr) | |
440 | extent = old_end - old_addr; | |
c49dd340 KS |
441 | next = (new_addr + size) & mask; |
442 | if (extent > next - new_addr) | |
443 | extent = next - new_addr; | |
444 | return extent; | |
445 | } | |
446 | ||
447 | /* | |
448 | * Attempts to speedup the move by moving entry at the level corresponding to | |
449 | * pgt_entry. Returns true if the move was successful, else false. | |
450 | */ | |
451 | static bool move_pgt_entry(enum pgt_entry entry, struct vm_area_struct *vma, | |
452 | unsigned long old_addr, unsigned long new_addr, | |
453 | void *old_entry, void *new_entry, bool need_rmap_locks) | |
454 | { | |
455 | bool moved = false; | |
456 | ||
457 | /* See comment in move_ptes() */ | |
458 | if (need_rmap_locks) | |
459 | take_rmap_locks(vma); | |
460 | ||
461 | switch (entry) { | |
462 | case NORMAL_PMD: | |
463 | moved = move_normal_pmd(vma, old_addr, new_addr, old_entry, | |
464 | new_entry); | |
465 | break; | |
466 | case NORMAL_PUD: | |
467 | moved = move_normal_pud(vma, old_addr, new_addr, old_entry, | |
468 | new_entry); | |
469 | break; | |
470 | case HPAGE_PMD: | |
471 | moved = IS_ENABLED(CONFIG_TRANSPARENT_HUGEPAGE) && | |
472 | move_huge_pmd(vma, old_addr, new_addr, old_entry, | |
473 | new_entry); | |
474 | break; | |
7d846db7 AK |
475 | case HPAGE_PUD: |
476 | moved = IS_ENABLED(CONFIG_TRANSPARENT_HUGEPAGE) && | |
477 | move_huge_pud(vma, old_addr, new_addr, old_entry, | |
478 | new_entry); | |
479 | break; | |
480 | ||
c49dd340 KS |
481 | default: |
482 | WARN_ON_ONCE(1); | |
483 | break; | |
484 | } | |
485 | ||
486 | if (need_rmap_locks) | |
487 | drop_rmap_locks(vma); | |
488 | ||
489 | return moved; | |
490 | } | |
491 | ||
b6a2fea3 | 492 | unsigned long move_page_tables(struct vm_area_struct *vma, |
1da177e4 | 493 | unsigned long old_addr, struct vm_area_struct *new_vma, |
38a76013 ML |
494 | unsigned long new_addr, unsigned long len, |
495 | bool need_rmap_locks) | |
1da177e4 | 496 | { |
c49dd340 | 497 | unsigned long extent, old_end; |
ac46d4f3 | 498 | struct mmu_notifier_range range; |
7be7a546 | 499 | pmd_t *old_pmd, *new_pmd; |
7d846db7 | 500 | pud_t *old_pud, *new_pud; |
1da177e4 | 501 | |
01e67e04 PB |
502 | if (!len) |
503 | return 0; | |
504 | ||
7be7a546 | 505 | old_end = old_addr + len; |
1da177e4 | 506 | |
550a7d60 MA |
507 | if (is_vm_hugetlb_page(vma)) |
508 | return move_hugetlb_page_tables(vma, new_vma, old_addr, | |
509 | new_addr, len); | |
510 | ||
3d0b95cd | 511 | flush_cache_range(vma, old_addr, old_end); |
7d4a8be0 | 512 | mmu_notifier_range_init(&range, MMU_NOTIFY_UNMAP, 0, vma->vm_mm, |
6f4f13e8 | 513 | old_addr, old_end); |
ac46d4f3 | 514 | mmu_notifier_invalidate_range_start(&range); |
7b6efc2b | 515 | |
7be7a546 | 516 | for (; old_addr < old_end; old_addr += extent, new_addr += extent) { |
1da177e4 | 517 | cond_resched(); |
c49dd340 KS |
518 | /* |
519 | * If extent is PUD-sized try to speed up the move by moving at the | |
520 | * PUD level if possible. | |
521 | */ | |
522 | extent = get_extent(NORMAL_PUD, old_addr, old_end, new_addr); | |
c49dd340 | 523 | |
7d846db7 AK |
524 | old_pud = get_old_pud(vma->vm_mm, old_addr); |
525 | if (!old_pud) | |
526 | continue; | |
527 | new_pud = alloc_new_pud(vma->vm_mm, vma, new_addr); | |
528 | if (!new_pud) | |
529 | break; | |
530 | if (pud_trans_huge(*old_pud) || pud_devmap(*old_pud)) { | |
531 | if (extent == HPAGE_PUD_SIZE) { | |
532 | move_pgt_entry(HPAGE_PUD, vma, old_addr, new_addr, | |
533 | old_pud, new_pud, need_rmap_locks); | |
534 | /* We ignore and continue on error? */ | |
c49dd340 | 535 | continue; |
7d846db7 AK |
536 | } |
537 | } else if (IS_ENABLED(CONFIG_HAVE_MOVE_PUD) && extent == PUD_SIZE) { | |
538 | ||
c49dd340 | 539 | if (move_pgt_entry(NORMAL_PUD, vma, old_addr, new_addr, |
97113eb3 | 540 | old_pud, new_pud, true)) |
c49dd340 KS |
541 | continue; |
542 | } | |
543 | ||
544 | extent = get_extent(NORMAL_PMD, old_addr, old_end, new_addr); | |
7be7a546 HD |
545 | old_pmd = get_old_pmd(vma->vm_mm, old_addr); |
546 | if (!old_pmd) | |
547 | continue; | |
8ac1f832 | 548 | new_pmd = alloc_new_pmd(vma->vm_mm, vma, new_addr); |
7be7a546 HD |
549 | if (!new_pmd) |
550 | break; | |
a5be621e | 551 | again: |
c49dd340 KS |
552 | if (is_swap_pmd(*old_pmd) || pmd_trans_huge(*old_pmd) || |
553 | pmd_devmap(*old_pmd)) { | |
554 | if (extent == HPAGE_PMD_SIZE && | |
555 | move_pgt_entry(HPAGE_PMD, vma, old_addr, new_addr, | |
556 | old_pmd, new_pmd, need_rmap_locks)) | |
557 | continue; | |
4b471e88 | 558 | split_huge_pmd(vma, old_pmd, old_addr); |
c49dd340 KS |
559 | } else if (IS_ENABLED(CONFIG_HAVE_MOVE_PMD) && |
560 | extent == PMD_SIZE) { | |
2c91bd4a JFG |
561 | /* |
562 | * If the extent is PMD-sized, try to speed the move by | |
563 | * moving at the PMD level if possible. | |
564 | */ | |
c49dd340 | 565 | if (move_pgt_entry(NORMAL_PMD, vma, old_addr, new_addr, |
97113eb3 | 566 | old_pmd, new_pmd, true)) |
2c91bd4a | 567 | continue; |
37a1c49a | 568 | } |
a5be621e HD |
569 | if (pmd_none(*old_pmd)) |
570 | continue; | |
4cf58924 | 571 | if (pte_alloc(new_vma->vm_mm, new_pmd)) |
37a1c49a | 572 | break; |
a5be621e HD |
573 | if (move_ptes(vma, old_pmd, old_addr, old_addr + extent, |
574 | new_vma, new_pmd, new_addr, need_rmap_locks) < 0) | |
575 | goto again; | |
1da177e4 | 576 | } |
7b6efc2b | 577 | |
ac46d4f3 | 578 | mmu_notifier_invalidate_range_end(&range); |
7be7a546 HD |
579 | |
580 | return len + old_addr - old_end; /* how much done */ | |
1da177e4 LT |
581 | } |
582 | ||
583 | static unsigned long move_vma(struct vm_area_struct *vma, | |
584 | unsigned long old_addr, unsigned long old_len, | |
72f87654 | 585 | unsigned long new_len, unsigned long new_addr, |
e346b381 BG |
586 | bool *locked, unsigned long flags, |
587 | struct vm_userfaultfd_ctx *uf, struct list_head *uf_unmap) | |
1da177e4 | 588 | { |
fdbef614 | 589 | long to_account = new_len - old_len; |
1da177e4 LT |
590 | struct mm_struct *mm = vma->vm_mm; |
591 | struct vm_area_struct *new_vma; | |
592 | unsigned long vm_flags = vma->vm_flags; | |
593 | unsigned long new_pgoff; | |
594 | unsigned long moved_len; | |
6b73cff2 LH |
595 | unsigned long account_start = 0; |
596 | unsigned long account_end = 0; | |
365e9c87 | 597 | unsigned long hiwater_vm; |
73d5e062 | 598 | int err = 0; |
38a76013 | 599 | bool need_rmap_locks; |
6b73cff2 | 600 | struct vma_iterator vmi; |
1da177e4 LT |
601 | |
602 | /* | |
603 | * We'd prefer to avoid failure later on in do_munmap: | |
604 | * which may split one vma into three before unmapping. | |
605 | */ | |
606 | if (mm->map_count >= sysctl_max_map_count - 3) | |
607 | return -ENOMEM; | |
608 | ||
fdbef614 DS |
609 | if (unlikely(flags & MREMAP_DONTUNMAP)) |
610 | to_account = new_len; | |
611 | ||
73d5e062 DS |
612 | if (vma->vm_ops && vma->vm_ops->may_split) { |
613 | if (vma->vm_start != old_addr) | |
614 | err = vma->vm_ops->may_split(vma, old_addr); | |
615 | if (!err && vma->vm_end != old_addr + old_len) | |
616 | err = vma->vm_ops->may_split(vma, old_addr + old_len); | |
617 | if (err) | |
618 | return err; | |
619 | } | |
620 | ||
1ff82995 HD |
621 | /* |
622 | * Advise KSM to break any KSM pages in the area to be moved: | |
623 | * it would be confusing if they were to turn up at the new | |
624 | * location, where they happen to coincide with different KSM | |
625 | * pages recently unmapped. But leave vma->vm_flags as it was, | |
626 | * so KSM can come around to merge on vma and new_vma afterwards. | |
627 | */ | |
7103ad32 HD |
628 | err = ksm_madvise(vma, old_addr, old_addr + old_len, |
629 | MADV_UNMERGEABLE, &vm_flags); | |
630 | if (err) | |
631 | return err; | |
1ff82995 | 632 | |
fdbef614 DS |
633 | if (vm_flags & VM_ACCOUNT) { |
634 | if (security_vm_enough_memory_mm(mm, to_account >> PAGE_SHIFT)) | |
ad8ee77e DS |
635 | return -ENOMEM; |
636 | } | |
637 | ||
d6ac235d | 638 | vma_start_write(vma); |
1da177e4 | 639 | new_pgoff = vma->vm_pgoff + ((old_addr - vma->vm_start) >> PAGE_SHIFT); |
38a76013 ML |
640 | new_vma = copy_vma(&vma, new_addr, new_len, new_pgoff, |
641 | &need_rmap_locks); | |
ad8ee77e | 642 | if (!new_vma) { |
fdbef614 DS |
643 | if (vm_flags & VM_ACCOUNT) |
644 | vm_unacct_memory(to_account >> PAGE_SHIFT); | |
1da177e4 | 645 | return -ENOMEM; |
ad8ee77e | 646 | } |
1da177e4 | 647 | |
38a76013 ML |
648 | moved_len = move_page_tables(vma, old_addr, new_vma, new_addr, old_len, |
649 | need_rmap_locks); | |
1da177e4 | 650 | if (moved_len < old_len) { |
df1eab30 | 651 | err = -ENOMEM; |
5477e70a | 652 | } else if (vma->vm_ops && vma->vm_ops->mremap) { |
14d07113 | 653 | err = vma->vm_ops->mremap(new_vma); |
df1eab30 ON |
654 | } |
655 | ||
656 | if (unlikely(err)) { | |
1da177e4 LT |
657 | /* |
658 | * On error, move entries back from new area to old, | |
659 | * which will succeed since page tables still there, | |
660 | * and then proceed to unmap new area instead of old. | |
661 | */ | |
38a76013 ML |
662 | move_page_tables(new_vma, new_addr, vma, old_addr, moved_len, |
663 | true); | |
1da177e4 LT |
664 | vma = new_vma; |
665 | old_len = new_len; | |
666 | old_addr = new_addr; | |
df1eab30 | 667 | new_addr = err; |
4abad2ca | 668 | } else { |
72f87654 | 669 | mremap_userfaultfd_prep(new_vma, uf); |
b2edffdd | 670 | } |
1da177e4 | 671 | |
550a7d60 MA |
672 | if (is_vm_hugetlb_page(vma)) { |
673 | clear_vma_resv_huge_pages(vma); | |
674 | } | |
675 | ||
1da177e4 | 676 | /* Conceal VM_ACCOUNT so old reservation is not undone */ |
ad8ee77e | 677 | if (vm_flags & VM_ACCOUNT && !(flags & MREMAP_DONTUNMAP)) { |
1c71222e | 678 | vm_flags_clear(vma, VM_ACCOUNT); |
6b73cff2 LH |
679 | if (vma->vm_start < old_addr) |
680 | account_start = vma->vm_start; | |
681 | if (vma->vm_end > old_addr + old_len) | |
682 | account_end = vma->vm_end; | |
1da177e4 LT |
683 | } |
684 | ||
71799062 | 685 | /* |
365e9c87 HD |
686 | * If we failed to move page tables we still do total_vm increment |
687 | * since do_munmap() will decrement it by old_len == new_len. | |
688 | * | |
689 | * Since total_vm is about to be raised artificially high for a | |
690 | * moment, we need to restore high watermark afterwards: if stats | |
691 | * are taken meanwhile, total_vm and hiwater_vm appear too high. | |
692 | * If this were a serious issue, we'd add a flag to do_munmap(). | |
71799062 | 693 | */ |
365e9c87 | 694 | hiwater_vm = mm->hiwater_vm; |
84638335 | 695 | vm_stat_account(mm, vma->vm_flags, new_len >> PAGE_SHIFT); |
71799062 | 696 | |
d9fe4fab TK |
697 | /* Tell pfnmap has moved from this vma */ |
698 | if (unlikely(vma->vm_flags & VM_PFNMAP)) | |
d155df53 | 699 | untrack_pfn_clear(vma); |
d9fe4fab | 700 | |
e346b381 | 701 | if (unlikely(!err && (flags & MREMAP_DONTUNMAP))) { |
e346b381 | 702 | /* We always clear VM_LOCKED[ONFAULT] on the old vma */ |
e430a95a | 703 | vm_flags_clear(vma, VM_LOCKED_MASK); |
e346b381 | 704 | |
1583aa27 LX |
705 | /* |
706 | * anon_vma links of the old vma is no longer needed after its page | |
707 | * table has been moved. | |
708 | */ | |
709 | if (new_vma != vma && vma->vm_start == old_addr && | |
710 | vma->vm_end == (old_addr + old_len)) | |
711 | unlink_anon_vmas(vma); | |
712 | ||
e346b381 | 713 | /* Because we won't unmap we don't need to touch locked_vm */ |
ad8ee77e | 714 | return new_addr; |
e346b381 BG |
715 | } |
716 | ||
6b73cff2 | 717 | vma_iter_init(&vmi, mm, old_addr); |
408579cd | 718 | if (!do_vmi_munmap(&vmi, mm, old_addr, old_len, uf_unmap, false)) { |
1da177e4 | 719 | /* OOM: unable to split vma, just get accounts right */ |
ad8ee77e | 720 | if (vm_flags & VM_ACCOUNT && !(flags & MREMAP_DONTUNMAP)) |
5e22928a | 721 | vm_acct_memory(old_len >> PAGE_SHIFT); |
6b73cff2 | 722 | account_start = account_end = 0; |
1da177e4 | 723 | } |
e346b381 BG |
724 | |
725 | if (vm_flags & VM_LOCKED) { | |
726 | mm->locked_vm += new_len >> PAGE_SHIFT; | |
727 | *locked = true; | |
728 | } | |
ad8ee77e | 729 | |
365e9c87 | 730 | mm->hiwater_vm = hiwater_vm; |
1da177e4 LT |
731 | |
732 | /* Restore VM_ACCOUNT if one or two pieces of vma left */ | |
6b73cff2 LH |
733 | if (account_start) { |
734 | vma = vma_prev(&vmi); | |
1c71222e | 735 | vm_flags_set(vma, VM_ACCOUNT); |
6b73cff2 LH |
736 | } |
737 | ||
738 | if (account_end) { | |
739 | vma = vma_next(&vmi); | |
1c71222e | 740 | vm_flags_set(vma, VM_ACCOUNT); |
1da177e4 LT |
741 | } |
742 | ||
1da177e4 LT |
743 | return new_addr; |
744 | } | |
745 | ||
54f5de70 | 746 | static struct vm_area_struct *vma_to_resize(unsigned long addr, |
fdbef614 | 747 | unsigned long old_len, unsigned long new_len, unsigned long flags) |
54f5de70 AV |
748 | { |
749 | struct mm_struct *mm = current->mm; | |
5aaf07f0 | 750 | struct vm_area_struct *vma; |
1d391686 | 751 | unsigned long pgoff; |
54f5de70 | 752 | |
5aaf07f0 LH |
753 | vma = vma_lookup(mm, addr); |
754 | if (!vma) | |
6cd57613 | 755 | return ERR_PTR(-EFAULT); |
54f5de70 | 756 | |
dba58d3b MK |
757 | /* |
758 | * !old_len is a special case where an attempt is made to 'duplicate' | |
759 | * a mapping. This makes no sense for private mappings as it will | |
760 | * instead create a fresh/new mapping unrelated to the original. This | |
761 | * is contrary to the basic idea of mremap which creates new mappings | |
762 | * based on the original. There are no known use cases for this | |
763 | * behavior. As a result, fail such attempts. | |
764 | */ | |
765 | if (!old_len && !(vma->vm_flags & (VM_SHARED | VM_MAYSHARE))) { | |
766 | pr_warn_once("%s (%d): attempted to duplicate a private mapping with mremap. This is not supported.\n", current->comm, current->pid); | |
767 | return ERR_PTR(-EINVAL); | |
768 | } | |
769 | ||
a4609387 BG |
770 | if ((flags & MREMAP_DONTUNMAP) && |
771 | (vma->vm_flags & (VM_DONTEXPAND | VM_PFNMAP))) | |
e346b381 BG |
772 | return ERR_PTR(-EINVAL); |
773 | ||
54f5de70 AV |
774 | /* We can't remap across vm area boundaries */ |
775 | if (old_len > vma->vm_end - addr) | |
6cd57613 | 776 | return ERR_PTR(-EFAULT); |
54f5de70 | 777 | |
1d391686 ON |
778 | if (new_len == old_len) |
779 | return vma; | |
780 | ||
982134ba | 781 | /* Need to be careful about a growing mapping */ |
1d391686 ON |
782 | pgoff = (addr - vma->vm_start) >> PAGE_SHIFT; |
783 | pgoff += vma->vm_pgoff; | |
784 | if (pgoff + (new_len >> PAGE_SHIFT) < pgoff) | |
785 | return ERR_PTR(-EINVAL); | |
786 | ||
787 | if (vma->vm_flags & (VM_DONTEXPAND | VM_PFNMAP)) | |
788 | return ERR_PTR(-EFAULT); | |
54f5de70 | 789 | |
b0cc5e89 | 790 | if (!mlock_future_ok(mm, vma->vm_flags, new_len - old_len)) |
f4331956 | 791 | return ERR_PTR(-EAGAIN); |
54f5de70 | 792 | |
84638335 KK |
793 | if (!may_expand_vm(mm, vma->vm_flags, |
794 | (new_len - old_len) >> PAGE_SHIFT)) | |
6cd57613 | 795 | return ERR_PTR(-ENOMEM); |
54f5de70 | 796 | |
54f5de70 | 797 | return vma; |
54f5de70 AV |
798 | } |
799 | ||
81909b84 | 800 | static unsigned long mremap_to(unsigned long addr, unsigned long old_len, |
72f87654 | 801 | unsigned long new_addr, unsigned long new_len, bool *locked, |
e346b381 | 802 | unsigned long flags, struct vm_userfaultfd_ctx *uf, |
b2282371 | 803 | struct list_head *uf_unmap_early, |
897ab3e0 | 804 | struct list_head *uf_unmap) |
ecc1a899 AV |
805 | { |
806 | struct mm_struct *mm = current->mm; | |
807 | struct vm_area_struct *vma; | |
808 | unsigned long ret = -EINVAL; | |
e346b381 | 809 | unsigned long map_flags = 0; |
ecc1a899 | 810 | |
f19cb115 | 811 | if (offset_in_page(new_addr)) |
ecc1a899 AV |
812 | goto out; |
813 | ||
814 | if (new_len > TASK_SIZE || new_addr > TASK_SIZE - new_len) | |
815 | goto out; | |
816 | ||
9943242c ON |
817 | /* Ensure the old/new locations do not overlap */ |
818 | if (addr + old_len > new_addr && new_addr + new_len > addr) | |
ecc1a899 AV |
819 | goto out; |
820 | ||
ea2c3f6f OS |
821 | /* |
822 | * move_vma() need us to stay 4 maps below the threshold, otherwise | |
823 | * it will bail out at the very beginning. | |
824 | * That is a problem if we have already unmaped the regions here | |
825 | * (new_addr, and old_addr), because userspace will not know the | |
826 | * state of the vma's after it gets -ENOMEM. | |
827 | * So, to avoid such scenario we can pre-compute if the whole | |
828 | * operation has high chances to success map-wise. | |
829 | * Worst-scenario case is when both vma's (new_addr and old_addr) get | |
f0953a1b | 830 | * split in 3 before unmapping it. |
ea2c3f6f OS |
831 | * That means 2 more maps (1 for each) to the ones we already hold. |
832 | * Check whether current map count plus 2 still leads us to 4 maps below | |
833 | * the threshold, otherwise return -ENOMEM here to be more safe. | |
834 | */ | |
835 | if ((mm->map_count + 2) >= sysctl_max_map_count - 3) | |
836 | return -ENOMEM; | |
837 | ||
e346b381 BG |
838 | if (flags & MREMAP_FIXED) { |
839 | ret = do_munmap(mm, new_addr, new_len, uf_unmap_early); | |
840 | if (ret) | |
841 | goto out; | |
842 | } | |
ecc1a899 | 843 | |
3c9fe8b8 | 844 | if (old_len > new_len) { |
897ab3e0 | 845 | ret = do_munmap(mm, addr+new_len, old_len - new_len, uf_unmap); |
3c9fe8b8 | 846 | if (ret) |
ecc1a899 AV |
847 | goto out; |
848 | old_len = new_len; | |
849 | } | |
850 | ||
fdbef614 | 851 | vma = vma_to_resize(addr, old_len, new_len, flags); |
ecc1a899 AV |
852 | if (IS_ERR(vma)) { |
853 | ret = PTR_ERR(vma); | |
854 | goto out; | |
855 | } | |
856 | ||
e346b381 BG |
857 | /* MREMAP_DONTUNMAP expands by old_len since old_len == new_len */ |
858 | if (flags & MREMAP_DONTUNMAP && | |
859 | !may_expand_vm(mm, vma->vm_flags, old_len >> PAGE_SHIFT)) { | |
860 | ret = -ENOMEM; | |
861 | goto out; | |
862 | } | |
863 | ||
864 | if (flags & MREMAP_FIXED) | |
865 | map_flags |= MAP_FIXED; | |
866 | ||
097eed10 AV |
867 | if (vma->vm_flags & VM_MAYSHARE) |
868 | map_flags |= MAP_SHARED; | |
9206de95 | 869 | |
097eed10 AV |
870 | ret = get_unmapped_area(vma->vm_file, new_addr, new_len, vma->vm_pgoff + |
871 | ((addr - vma->vm_start) >> PAGE_SHIFT), | |
872 | map_flags); | |
ff68dac6 | 873 | if (IS_ERR_VALUE(ret)) |
fdbef614 | 874 | goto out; |
097eed10 | 875 | |
e346b381 BG |
876 | /* We got a new mapping */ |
877 | if (!(flags & MREMAP_FIXED)) | |
878 | new_addr = ret; | |
879 | ||
880 | ret = move_vma(vma, addr, old_len, new_len, new_addr, locked, flags, uf, | |
897ab3e0 | 881 | uf_unmap); |
e346b381 | 882 | |
ecc1a899 AV |
883 | out: |
884 | return ret; | |
885 | } | |
886 | ||
1a0ef85f AV |
887 | static int vma_expandable(struct vm_area_struct *vma, unsigned long delta) |
888 | { | |
f106af4e | 889 | unsigned long end = vma->vm_end + delta; |
396a44cc | 890 | |
9206de95 | 891 | if (end < vma->vm_end) /* overflow */ |
f106af4e | 892 | return 0; |
396a44cc | 893 | if (find_vma_intersection(vma->vm_mm, vma->vm_end, end)) |
f106af4e AV |
894 | return 0; |
895 | if (get_unmapped_area(NULL, vma->vm_start, end - vma->vm_start, | |
896 | 0, MAP_FIXED) & ~PAGE_MASK) | |
1a0ef85f | 897 | return 0; |
1a0ef85f AV |
898 | return 1; |
899 | } | |
900 | ||
1da177e4 LT |
901 | /* |
902 | * Expand (or shrink) an existing mapping, potentially moving it at the | |
903 | * same time (controlled by the MREMAP_MAYMOVE flag and available VM space) | |
904 | * | |
905 | * MREMAP_FIXED option added 5-Dec-1999 by Benjamin LaHaise | |
906 | * This option implies MREMAP_MAYMOVE. | |
907 | */ | |
63a81db1 AV |
908 | SYSCALL_DEFINE5(mremap, unsigned long, addr, unsigned long, old_len, |
909 | unsigned long, new_len, unsigned long, flags, | |
910 | unsigned long, new_addr) | |
1da177e4 | 911 | { |
d0de32d9 | 912 | struct mm_struct *mm = current->mm; |
1da177e4 LT |
913 | struct vm_area_struct *vma; |
914 | unsigned long ret = -EINVAL; | |
81909b84 | 915 | bool locked = false; |
72f87654 | 916 | struct vm_userfaultfd_ctx uf = NULL_VM_UFFD_CTX; |
b2282371 | 917 | LIST_HEAD(uf_unmap_early); |
897ab3e0 | 918 | LIST_HEAD(uf_unmap); |
1da177e4 | 919 | |
b2a84de2 WD |
920 | /* |
921 | * There is a deliberate asymmetry here: we strip the pointer tag | |
922 | * from the old address but leave the new address alone. This is | |
923 | * for consistency with mmap(), where we prevent the creation of | |
924 | * aliasing mappings in userspace by leaving the tag bits of the | |
925 | * mapping address intact. A non-zero tag will cause the subsequent | |
926 | * range checks to reject the address as invalid. | |
927 | * | |
c3003405 JC |
928 | * See Documentation/arch/arm64/tagged-address-abi.rst for more |
929 | * information. | |
b2a84de2 | 930 | */ |
057d3389 AK |
931 | addr = untagged_addr(addr); |
932 | ||
e346b381 | 933 | if (flags & ~(MREMAP_FIXED | MREMAP_MAYMOVE | MREMAP_DONTUNMAP)) |
9a2458a6 RV |
934 | return ret; |
935 | ||
936 | if (flags & MREMAP_FIXED && !(flags & MREMAP_MAYMOVE)) | |
937 | return ret; | |
1da177e4 | 938 | |
e346b381 BG |
939 | /* |
940 | * MREMAP_DONTUNMAP is always a move and it does not allow resizing | |
941 | * in the process. | |
942 | */ | |
943 | if (flags & MREMAP_DONTUNMAP && | |
944 | (!(flags & MREMAP_MAYMOVE) || old_len != new_len)) | |
945 | return ret; | |
946 | ||
947 | ||
f19cb115 | 948 | if (offset_in_page(addr)) |
9a2458a6 | 949 | return ret; |
1da177e4 LT |
950 | |
951 | old_len = PAGE_ALIGN(old_len); | |
952 | new_len = PAGE_ALIGN(new_len); | |
953 | ||
954 | /* | |
955 | * We allow a zero old-len as a special case | |
956 | * for DOS-emu "duplicate shm area" thing. But | |
957 | * a zero new-len is nonsensical. | |
958 | */ | |
959 | if (!new_len) | |
9a2458a6 RV |
960 | return ret; |
961 | ||
d8ed45c5 | 962 | if (mmap_write_lock_killable(current->mm)) |
dc0ef0df | 963 | return -EINTR; |
0e6799db ML |
964 | vma = vma_lookup(mm, addr); |
965 | if (!vma) { | |
7d1e6496 | 966 | ret = -EFAULT; |
550a7d60 MA |
967 | goto out; |
968 | } | |
969 | ||
970 | if (is_vm_hugetlb_page(vma)) { | |
971 | struct hstate *h __maybe_unused = hstate_vma(vma); | |
972 | ||
973 | old_len = ALIGN(old_len, huge_page_size(h)); | |
974 | new_len = ALIGN(new_len, huge_page_size(h)); | |
975 | ||
976 | /* addrs must be huge page aligned */ | |
977 | if (addr & ~huge_page_mask(h)) | |
978 | goto out; | |
979 | if (new_addr & ~huge_page_mask(h)) | |
980 | goto out; | |
981 | ||
982 | /* | |
983 | * Don't allow remap expansion, because the underlying hugetlb | |
984 | * reservation is not yet capable to handle split reservation. | |
985 | */ | |
986 | if (new_len > old_len) | |
987 | goto out; | |
988 | } | |
1da177e4 | 989 | |
e346b381 | 990 | if (flags & (MREMAP_FIXED | MREMAP_DONTUNMAP)) { |
9a2458a6 | 991 | ret = mremap_to(addr, old_len, new_addr, new_len, |
e346b381 BG |
992 | &locked, flags, &uf, &uf_unmap_early, |
993 | &uf_unmap); | |
ecc1a899 | 994 | goto out; |
1da177e4 LT |
995 | } |
996 | ||
997 | /* | |
998 | * Always allow a shrinking remap: that just unmaps | |
999 | * the unnecessary pages.. | |
183654ce | 1000 | * do_vmi_munmap does all the needed commit accounting, and |
408579cd | 1001 | * unlocks the mmap_lock if so directed. |
1da177e4 LT |
1002 | */ |
1003 | if (old_len >= new_len) { | |
183654ce | 1004 | VMA_ITERATOR(vmi, mm, addr + new_len); |
85a06835 | 1005 | |
408579cd LH |
1006 | if (old_len == new_len) { |
1007 | ret = addr; | |
11f9a21a LH |
1008 | goto out; |
1009 | } | |
1010 | ||
408579cd LH |
1011 | ret = do_vmi_munmap(&vmi, mm, addr + new_len, old_len - new_len, |
1012 | &uf_unmap, true); | |
1013 | if (ret) | |
1014 | goto out; | |
1015 | ||
1da177e4 | 1016 | ret = addr; |
408579cd | 1017 | goto out_unlocked; |
1da177e4 LT |
1018 | } |
1019 | ||
1020 | /* | |
ecc1a899 | 1021 | * Ok, we need to grow.. |
1da177e4 | 1022 | */ |
fdbef614 | 1023 | vma = vma_to_resize(addr, old_len, new_len, flags); |
54f5de70 AV |
1024 | if (IS_ERR(vma)) { |
1025 | ret = PTR_ERR(vma); | |
1da177e4 | 1026 | goto out; |
119f657c | 1027 | } |
1da177e4 | 1028 | |
1da177e4 | 1029 | /* old_len exactly to the end of the area.. |
1da177e4 | 1030 | */ |
ecc1a899 | 1031 | if (old_len == vma->vm_end - addr) { |
1da177e4 | 1032 | /* can we just expand the current mapping? */ |
1a0ef85f | 1033 | if (vma_expandable(vma, new_len - old_len)) { |
fdbef614 | 1034 | long pages = (new_len - old_len) >> PAGE_SHIFT; |
ca3d76b0 JM |
1035 | unsigned long extension_start = addr + old_len; |
1036 | unsigned long extension_end = addr + new_len; | |
6f12be79 VB |
1037 | pgoff_t extension_pgoff = vma->vm_pgoff + |
1038 | ((extension_start - vma->vm_start) >> PAGE_SHIFT); | |
a27a11f9 | 1039 | VMA_ITERATOR(vmi, mm, extension_start); |
fdbef614 DS |
1040 | |
1041 | if (vma->vm_flags & VM_ACCOUNT) { | |
1042 | if (security_vm_enough_memory_mm(mm, pages)) { | |
1043 | ret = -ENOMEM; | |
1044 | goto out; | |
1045 | } | |
1046 | } | |
1da177e4 | 1047 | |
ca3d76b0 | 1048 | /* |
d014cd7c VB |
1049 | * Function vma_merge() is called on the extension we |
1050 | * are adding to the already existing vma, vma_merge() | |
1051 | * will merge this extension with the already existing | |
1052 | * vma (expand operation itself) and possibly also with | |
1053 | * the next vma if it becomes adjacent to the expanded | |
1054 | * vma and otherwise compatible. | |
ca3d76b0 | 1055 | */ |
4bfbe371 VB |
1056 | vma = vma_merge(&vmi, mm, vma, extension_start, |
1057 | extension_end, vma->vm_flags, vma->anon_vma, | |
1058 | vma->vm_file, extension_pgoff, vma_policy(vma), | |
1059 | vma->vm_userfaultfd_ctx, anon_vma_name(vma)); | |
ca3d76b0 | 1060 | if (!vma) { |
fdbef614 | 1061 | vm_unacct_memory(pages); |
5beb4930 RR |
1062 | ret = -ENOMEM; |
1063 | goto out; | |
1064 | } | |
1da177e4 | 1065 | |
84638335 | 1066 | vm_stat_account(mm, vma->vm_flags, pages); |
1da177e4 | 1067 | if (vma->vm_flags & VM_LOCKED) { |
d0de32d9 | 1068 | mm->locked_vm += pages; |
81909b84 ML |
1069 | locked = true; |
1070 | new_addr = addr; | |
1da177e4 LT |
1071 | } |
1072 | ret = addr; | |
1073 | goto out; | |
1074 | } | |
1075 | } | |
1076 | ||
1077 | /* | |
1078 | * We weren't able to just expand or shrink the area, | |
1079 | * we need to create a new one and move it.. | |
1080 | */ | |
1081 | ret = -ENOMEM; | |
1082 | if (flags & MREMAP_MAYMOVE) { | |
ecc1a899 AV |
1083 | unsigned long map_flags = 0; |
1084 | if (vma->vm_flags & VM_MAYSHARE) | |
1085 | map_flags |= MAP_SHARED; | |
1086 | ||
1087 | new_addr = get_unmapped_area(vma->vm_file, 0, new_len, | |
93587414 AV |
1088 | vma->vm_pgoff + |
1089 | ((addr - vma->vm_start) >> PAGE_SHIFT), | |
1090 | map_flags); | |
ff68dac6 | 1091 | if (IS_ERR_VALUE(new_addr)) { |
ecc1a899 AV |
1092 | ret = new_addr; |
1093 | goto out; | |
1da177e4 | 1094 | } |
ecc1a899 | 1095 | |
72f87654 | 1096 | ret = move_vma(vma, addr, old_len, new_len, new_addr, |
e346b381 | 1097 | &locked, flags, &uf, &uf_unmap); |
1da177e4 LT |
1098 | } |
1099 | out: | |
fdbef614 | 1100 | if (offset_in_page(ret)) |
fa1f68cc | 1101 | locked = false; |
408579cd | 1102 | mmap_write_unlock(current->mm); |
81909b84 ML |
1103 | if (locked && new_len > old_len) |
1104 | mm_populate(new_addr + old_len, new_len - old_len); | |
408579cd | 1105 | out_unlocked: |
b2282371 | 1106 | userfaultfd_unmap_complete(mm, &uf_unmap_early); |
d1564926 | 1107 | mremap_userfaultfd_complete(&uf, addr, ret, old_len); |
897ab3e0 | 1108 | userfaultfd_unmap_complete(mm, &uf_unmap); |
1da177e4 LT |
1109 | return ret; |
1110 | } |