mm/mmap: Fix unmapped_area_topdown() and expand_downwards()

Signed-off-by: Liam R. Howlett <Liam.Howlett@oracle.com>

diff --git a/mm/mmap.c b/mm/mmap.c
index 74a4608ac64f7a0ebc0f9e4a588bc4fe90b04fed..0b470caa74df6ba88d0dff73531f67464b2e51a0 100644 (file)
--- a/mm/mmap.c
+++ b/mm/mmap.c
@@ -1638,8 +1638,8 @@ static unsigned long unmapped_area_topdown(struct vm_unmapped_area_info *info)
                                length))
                return -ENOMEM;
 
-       gap = (mas.index + info->align_mask) & ~info->align_mask;
-       gap -= info->align_offset & info->align_mask;
+       gap = mas.last + 1 - info->length;
+       gap -= (gap - info->align_offset) & info->align_mask;
        return gap;
 }
 
@@ -2003,6 +2003,7 @@ int expand_upwards(struct vm_area_struct *vma, unsigned long address)
                                vm_stat_account(mm, vma->vm_flags, grow);
                                anon_vma_interval_tree_pre_update_vma(vma);
                                vma->vm_end = address;
+                               /* Overwrite old entry in mtree. */
                                vma_store(mm, vma);
                                anon_vma_interval_tree_post_update_vma(vma);
                                spin_unlock(&mm->page_table_lock);
@@ -2023,6 +2024,7 @@ int expand_upwards(struct vm_area_struct *vma, unsigned long address)
 int expand_downwards(struct vm_area_struct *vma, unsigned long address)
 {
        struct mm_struct *mm = vma->vm_mm;
+       MA_STATE(mas, &mm->mm_mt, vma->vm_start, vma->vm_start);
        struct vm_area_struct *prev;
        int error = 0;
 
@@ -2031,7 +2033,7 @@ int expand_downwards(struct vm_area_struct *vma, unsigned long address)
                return -EPERM;
 
        /* Enforce stack_guard_gap */
-       find_vma_prev(mm, vma->vm_start, &prev);
+       prev = mas_prev(&mas, 0);
        /* Check that both stack segments have the same anon_vma? */
        if (prev && !(prev->vm_flags & VM_GROWSDOWN) &&
                        vma_is_accessible(prev)) {