Hugh Dickins d05f0cdcbe mm: fix crashes from mbind() merging vmas ...

In v2.6.34 commit 9d8cebd4bc ("mm: fix mbind vma merge problem")
introduced vma merging to mbind(), but it should have also changed the
convention of passing start vma from queue_pages_range() (formerly
check_range()) to new_vma_page(): vma merging may have already freed
that structure, resulting in BUG at mm/mempolicy.c:1738 and probably
worse crashes.

Fixes: 9d8cebd4bc ("mm: fix mbind vma merge problem")
Reported-by: Naoya Horiguchi <[email protected]>
Tested-by: Naoya Horiguchi <[email protected]>
Signed-off-by: Hugh Dickins <[email protected]>
Acked-by: Christoph Lameter <[email protected]>
Cc: KOSAKI Motohiro <[email protected]>
Cc: Minchan Kim <[email protected]>
Cc: <[email protected]>	[2.6.34+]
Signed-off-by: Andrew Morton <[email protected]>
Signed-off-by: Linus Torvalds <[email protected]>

2014-06-23 16:47:44 -07:00

..

backing-dev.c

arch: Mass conversion of smp_mb__*()

2014-04-18 14:20:48 +02:00

balloon_compaction.c

mm: print more details for bad_page()

2014-01-23 16:36:50 -08:00

bootmem.c

mm/bootmem.c: remove unused local `map'

2013-11-13 12:09:09 +09:00

cleancache.c

mm: dump page when hitting a VM_BUG_ON using VM_BUG_ON_PAGE

2014-01-23 16:36:50 -08:00

compaction.c

mm, compaction: properly signal and act upon lock and need_sched() contention

2014-06-04 16:54:11 -07:00

debug-pagealloc.c

…

dmapool.c

mm/dmapool.c: reuse devres_release() to free resources

2014-06-04 16:54:08 -07:00

early_ioremap.c

mm: create generic early_ioremap() support

2014-04-07 16:36:15 -07:00

fadvise.c

…

failslab.c

…

filemap_xip.c

…

filemap.c

Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs

2014-06-12 10:30:18 -07:00

fremap.c

mm: mark remap_file_pages() syscall as deprecated

2014-06-06 16:08:17 -07:00

frontswap.c

swap: change swap_list_head to plist, add swap_avail_head

2014-06-04 16:54:07 -07:00

gup.c

mm: cleanup __get_user_pages()

2014-06-04 16:54:05 -07:00

highmem.c

…

huge_memory.c

mm: let mm_find_pmd fix buggy race with THP fault

2014-06-23 16:47:44 -07:00

hugetlb_cgroup.c

cgroup: remove css_parent()

2014-05-16 13:22:48 -04:00

hugetlb.c

hugetlb: fix copy_hugetlb_page_range() to handle migration/hwpoisoned entry

2014-06-23 16:47:43 -07:00

hwpoison-inject.c

mm/hwpoison: add '#' to hwpoison_inject

2014-01-21 16:19:48 -08:00

init-mm.c

…

internal.h

mm, compaction: properly signal and act upon lock and need_sched() contention

2014-06-04 16:54:11 -07:00

interval_tree.c

…

iov_iter.c

bio_vec-backed iov_iter

2014-05-06 17:39:45 -04:00

Kconfig

mm/zsmalloc: make zsmalloc module-buildable

2014-06-04 16:54:14 -07:00

Kconfig.debug

…

kmemcheck.c

…

kmemleak-test.c

mm/kmemleak-test.c: use pr_fmt for logging

2014-06-06 16:08:18 -07:00

kmemleak.c

mm: introduce kmemleak_update_trace()

2014-06-06 16:08:17 -07:00

ksm.c

mm: let mm_find_pmd fix buggy race with THP fault

2014-06-23 16:47:44 -07:00

list_lru.c

mm: keep page cache radix tree nodes in check

2014-04-03 16:21:01 -07:00

maccess.c

…

madvise.c

mm: madvise: fix MADV_WILLNEED on shmem swapouts

2014-05-23 09:37:29 -07:00

Makefile

mm: move get_user_pages()-related code to separate file

2014-06-04 16:54:04 -07:00

memblock.c

mm/memblock.c: call kmemleak directly from memblock_(alloc|free)

2014-06-06 16:08:17 -07:00

memcontrol.c

Merge branch 'for-3.16' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/cgroup

2014-06-09 15:03:33 -07:00

memory_hotplug.c

mm, migration: add destination page freeing callback

2014-06-04 16:54:06 -07:00

memory-failure.c

mm/memory-failure.c: support use of a dedicated thread to handle SIGBUS(BUS_MCEERR_AO)

2014-06-04 16:54:13 -07:00

memory.c

mm: document do_fault_around() feature

2014-06-04 16:54:12 -07:00

mempolicy.c

mm: fix crashes from mbind() merging vmas

2014-06-23 16:47:44 -07:00

mempool.c

mm/mempool.c: update the kmemleak stack trace for mempool allocations

2014-06-06 16:08:17 -07:00

migrate.c

mm: let mm_find_pmd fix buggy race with THP fault

2014-06-23 16:47:44 -07:00

mincore.c

mm + fs: prepare for non-page entries in page cache radix trees

2014-04-03 16:21:00 -07:00

mlock.c

mm: try_to_unmap_cluster() should lock_page() before mlocking

2014-04-07 16:35:57 -07:00

mm_init.c

mm: bring back /sys/kernel/mm

2014-01-27 21:02:39 -08:00

mmap.c

mm: convert some level-less printks to pr_*

2014-06-06 16:08:18 -07:00

mmu_context.c

sched/mm: call finish_arch_post_lock_switch in idle_task_exit and use_mm

2014-02-21 08:50:17 +01:00

mmu_notifier.c

mm: audit/fix non-modular users of module_init in core code

2014-01-23 16:36:52 -08:00

mmzone.c

…

mprotect.c

mm: move mmu notifier call from change_protection to change_pmd_range

2014-04-07 16:35:50 -07:00

mremap.c

mm, thp: close race between mremap() and split_huge_page()

2014-05-11 17:55:48 +09:00

msync.c

mm/msync.c: sync only the requested range in msync()

2014-06-04 16:54:11 -07:00

nobootmem.c

mm/memblock.c: call kmemleak directly from memblock_(alloc|free)

2014-06-06 16:08:17 -07:00

nommu.c

mm: nommu: per-thread vma cache fix

2014-06-23 16:47:43 -07:00

oom_kill.c

mm, oom: base root bonus on current usage

2014-01-30 16:56:56 -08:00

page_alloc.c

mm, pcp: allow restoring percpu_pagelist_fraction default

2014-06-23 16:47:43 -07:00

page_cgroup.c

mm/page_cgroup.c: mark functions as static

2014-04-03 16:21:02 -07:00

page_io.c

fix __swap_writepage() compile failure on old gcc versions

2014-06-14 19:30:48 -05:00

page_isolation.c

…

page-writeback.c

Merge tag 'ext4_for_linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tytso/ext4

2014-06-08 13:03:35 -07:00

pagewalk.c

…

percpu-km.c

…

percpu-vm.c

…

percpu.c

percpu: make pcpu_alloc_chunk() use pcpu_mem_free() instead of kfree()

2014-04-14 16:18:06 -04:00

pgtable-generic.c

mm: fix TLB flush race between migration, and change_protection_range

2013-12-18 19:04:51 -08:00

process_vm_access.c

start adding the tag to iov_iter

2014-05-06 17:32:49 -04:00

quicklist.c

…

readahead.c

mm/readahead.c: inline ra_submit

2014-04-07 16:35:58 -07:00

rmap.c

mm: let mm_find_pmd fix buggy race with THP fault

2014-06-23 16:47:44 -07:00

shmem.c

shmem: fix faulting into a hole while it's punched

2014-06-23 16:47:44 -07:00

slab_common.c

slab: delete cache from list after __kmem_cache_shutdown succeeds

2014-06-04 16:54:08 -07:00

slab.c

slab: fix oops when reading /proc/slab_allocators

2014-06-23 16:47:44 -07:00

slab.h

memcg, slab: merge memcg_{bind,release}_pages to memcg_{un}charge_slab

2014-06-04 16:54:01 -07:00

slob.c

slab: get_online_mems for kmem_cache_{create,destroy,shrink}

2014-06-04 16:53:59 -07:00

slub.c

slub: search partial list on numa_mem_id(), instead of numa_node_id()

2014-06-06 16:08:06 -07:00

sparse-vmemmap.c

mm/sparse: use memblock apis for early memory allocations

2014-01-21 16:19:47 -08:00

sparse.c

mm: use macros from compiler.h instead of __attribute__((...))

2014-04-07 16:35:54 -07:00

swap_state.c

mm: page_alloc: convert hot/cold parameter and immediate callers to bool

2014-06-04 16:54:09 -07:00

swap.c

mm: non-atomically mark page accessed during page cache allocation where possible

2014-06-04 16:54:10 -07:00

swapfile.c

mm/swapfile.c: delete the "last_in_cluster < scan_base" loop in the body of scan_swap_map()

2014-06-04 16:54:12 -07:00

truncate.c

mm: filemap: update find_get_pages_tag() to deal with shadow entries

2014-05-06 13:04:59 -07:00

util.c

nick kvfree() from apparmor

2014-05-06 14:02:53 -04:00

vmacache.c

mm,vmacache: optimize overflow system-wide flushing

2014-06-04 16:53:57 -07:00

vmalloc.c

mm/vmalloc.c: export unmap_kernel_range()

2014-06-04 16:54:14 -07:00

vmpressure.c

arm, pm, vmpressure: add missing slab.h includes

2014-02-03 13:24:01 -05:00

vmscan.c

Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs

2014-06-12 10:30:18 -07:00

vmstat.c

mm: use the light version __mod_zone_page_state in mlocked_vma_newpage()

2014-06-04 16:54:07 -07:00

workingset.c

mm: keep page cache radix tree nodes in check

2014-04-03 16:21:01 -07:00

zbud.c

mm/zbud.c: make size unsigned like unique callsite

2014-06-04 16:54:13 -07:00

zsmalloc.c

zsmalloc: fixup trivial zs size classes value in comments

2014-06-04 16:54:13 -07:00

zswap.c

mm/zswap: NUMA aware allocation for zswap_dstmem

2014-06-04 16:54:14 -07:00