linked list mess

Signed-off-by: Liam R. Howlett <Liam.Howlett@Oracle.com>

diff --git a/ipc/shm.c b/ipc/shm.c
index 02f4c941369025b921c38a3e79a254452363e4ee..4ad87883520996179df74d9a5d9cafd83cb46a4f 100644 (file)
--- a/ipc/shm.c
+++ b/ipc/shm.c
@@ -1703,13 +1703,14 @@ long ksys_shmdt(char __user *shmaddr)
         * prevent overflows and make comparisons vs. equal-width types.
         */
        size = PAGE_ALIGN(size);
-
-       mas_for_each(&mas, vma, size) {
+       while (vma && (loff_t)(vma->vm_end - addr) <= size) {
                /* finding a matching vma now does not alter retval */
                if ((vma->vm_ops == &shm_vm_ops) &&
                    ((vma->vm_start - addr)/PAGE_SIZE == vma->vm_pgoff) &&
                    (vma->vm_file == file))
                        do_munmap(mm, vma->vm_start, vma->vm_end - vma->vm_start, NULL);
+
+               vma = mas_find(&mas, addr + size - 1);
        }
 
 #else  /* CONFIG_MMU */

diff --git a/kernel/sched/fair.c b/kernel/sched/fair.c
index 710727741538350b7581a8d31550ffd65c260d8c..1cb3a245ffd85c166d8d9d6f628e7674ad687b63 100644 (file)
--- a/kernel/sched/fair.c
+++ b/kernel/sched/fair.c
@@ -2781,7 +2781,6 @@ static void task_numa_work(struct callback_head *work)
        vma = mas_walk(&mas);
        if (!vma) {
                reset_ptenuma_scan(p);
-               mas_reset(&mas);
                start = 0;
                mas_set(&mas, start);
        }

diff --git a/mm/ksm.c b/mm/ksm.c
index 2e9e685c588fc6d2b8321d56c2c8af83c7c69b2c..defe9c3eb9a91b61a438642f62f5689cfae6123d 100644 (file)
--- a/mm/ksm.c
+++ b/mm/ksm.c
@@ -979,6 +979,7 @@ static int unmerge_and_remove_all_rmap_items(void)
                        mm_slot != &ksm_mm_head; mm_slot = ksm_scan.mm_slot) {
                mm = mm_slot->mm;
                mmap_read_lock(mm);
+               mas_set(&mas, 0);
                mas_for_each(&mas, vma, ULONG_MAX) {
                        if (ksm_test_exit(mm))
                                break;
@@ -2290,12 +2291,9 @@ next_mm:
        mm = slot->mm;
        mmap_read_lock(mm);
        if (ksm_test_exit(mm))
-               vma = NULL;
-       else {
-               mas_set(&mas, ksm_scan.address);
-               vma = mas_find(&mas, ULONG_MAX);
-       }
+               goto no_vmas;
 
+       mas_set(&mas, ksm_scan.address);
        mas_for_each(&mas, vma, ULONG_MAX) {
                if (!(vma->vm_flags & VM_MERGEABLE))
                        continue;
@@ -2334,6 +2332,7 @@ next_mm:
        }
 
        if (ksm_test_exit(mm)) {
+no_vmas:
                ksm_scan.address = 0;
                ksm_scan.rmap_list = &slot->rmap_list;
        }

diff --git a/mm/mempolicy.c b/mm/mempolicy.c
index 4757b7939920655ed7f07225e8d9de61709ba874..e0b8e658f18eb0fcfa7cd3fe34f97fb271d97f2b 100644 (file)
--- a/mm/mempolicy.c
+++ b/mm/mempolicy.c
@@ -820,7 +820,7 @@ static int mbind_range(struct mm_struct *mm, unsigned long start,
        if (start > vma->vm_start)
                prev = vma;
 
-       mas_for_each(&mas, vma, end) {
+       mas_for_each(&mas, vma, end - 1) {
                next = vma_next(mm, vma);
                vmstart = max(start, vma->vm_start);
                vmend   = min(end, vma->vm_end);
@@ -850,6 +850,7 @@ static int mbind_range(struct mm_struct *mm, unsigned long start,
                        err = split_vma(vma->vm_mm, vma, vmend, 0);
                        if (err)
                                goto out;
+                       mas_pause(&mas);
                }
  replace:
                err = vma_replace_policy(vma, new_pol);

diff --git a/mm/mprotect.c b/mm/mprotect.c
index 5492833af73b549fab4e66f3563db9416efcbe5d..a6208b872336e31dbe09491f1c75f589a9fd2a7e 100644 (file)
--- a/mm/mprotect.c
+++ b/mm/mprotect.c
@@ -550,11 +550,12 @@ static int do_mprotect_pkey(unsigned long start, size_t len,
        if ((pkey != -1) && !mm_pkey_is_allocated(current->mm, pkey))
                goto out;
 
+       mas_set(&mas, start);
        vma = mas_walk(&mas);
        error = -ENOMEM;
        if (!vma)
                goto out;
-       prev = vma_prev(vma->vm_mm, vma);
+       prev = mas_prev(&mas, 0);
        if (unlikely(grows & PROT_GROWSDOWN)) {
                if (vma->vm_start >= end)
                        goto out;