mremap.c 16.4 KB
Newer Older
L
Linus Torvalds 已提交
1 2 3 4 5
/*
 *	mm/mremap.c
 *
 *	(C) Copyright 1996 Linus Torvalds
 *
A
Alan Cox 已提交
6
 *	Address space accounting code	<alan@lxorguk.ukuu.org.uk>
L
Linus Torvalds 已提交
7 8 9 10 11 12
 *	(C) Copyright 2002 Red Hat Inc, All Rights Reserved
 */

#include <linux/mm.h>
#include <linux/hugetlb.h>
#include <linux/shm.h>
13
#include <linux/ksm.h>
L
Linus Torvalds 已提交
14 15
#include <linux/mman.h>
#include <linux/swap.h>
16
#include <linux/capability.h>
L
Linus Torvalds 已提交
17
#include <linux/fs.h>
18
#include <linux/swapops.h>
L
Linus Torvalds 已提交
19 20 21
#include <linux/highmem.h>
#include <linux/security.h>
#include <linux/syscalls.h>
A
Andrea Arcangeli 已提交
22
#include <linux/mmu_notifier.h>
P
Paul McQuade 已提交
23
#include <linux/uaccess.h>
L
Laurent Dufour 已提交
24
#include <linux/mm-arch-hooks.h>
25
#include <linux/userfaultfd_k.h>
L
Linus Torvalds 已提交
26 27 28 29

#include <asm/cacheflush.h>
#include <asm/tlbflush.h>

30 31
#include "internal.h"

32
static pmd_t *get_old_pmd(struct mm_struct *mm, unsigned long addr)
L
Linus Torvalds 已提交
33 34
{
	pgd_t *pgd;
35
	p4d_t *p4d;
L
Linus Torvalds 已提交
36 37 38 39 40 41 42
	pud_t *pud;
	pmd_t *pmd;

	pgd = pgd_offset(mm, addr);
	if (pgd_none_or_clear_bad(pgd))
		return NULL;

43 44 45 46 47
	p4d = p4d_offset(pgd, addr);
	if (p4d_none_or_clear_bad(p4d))
		return NULL;

	pud = pud_offset(p4d, addr);
L
Linus Torvalds 已提交
48 49 50 51
	if (pud_none_or_clear_bad(pud))
		return NULL;

	pmd = pmd_offset(pud, addr);
52
	if (pmd_none(*pmd))
L
Linus Torvalds 已提交
53 54
		return NULL;

55
	return pmd;
L
Linus Torvalds 已提交
56 57
}

58 59
static pmd_t *alloc_new_pmd(struct mm_struct *mm, struct vm_area_struct *vma,
			    unsigned long addr)
L
Linus Torvalds 已提交
60 61
{
	pgd_t *pgd;
62
	p4d_t *p4d;
L
Linus Torvalds 已提交
63
	pud_t *pud;
H
Hugh Dickins 已提交
64
	pmd_t *pmd;
L
Linus Torvalds 已提交
65 66

	pgd = pgd_offset(mm, addr);
67 68 69 70
	p4d = p4d_alloc(mm, pgd, addr);
	if (!p4d)
		return NULL;
	pud = pud_alloc(mm, p4d, addr);
L
Linus Torvalds 已提交
71
	if (!pud)
H
Hugh Dickins 已提交
72
		return NULL;
73

L
Linus Torvalds 已提交
74
	pmd = pmd_alloc(mm, pud, addr);
H
Hugh Dickins 已提交
75
	if (!pmd)
H
Hugh Dickins 已提交
76
		return NULL;
77

78
	VM_BUG_ON(pmd_trans_huge(*pmd));
H
Hugh Dickins 已提交
79

80
	return pmd;
L
Linus Torvalds 已提交
81 82
}

83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98
static void take_rmap_locks(struct vm_area_struct *vma)
{
	if (vma->vm_file)
		i_mmap_lock_write(vma->vm_file->f_mapping);
	if (vma->anon_vma)
		anon_vma_lock_write(vma->anon_vma);
}

static void drop_rmap_locks(struct vm_area_struct *vma)
{
	if (vma->anon_vma)
		anon_vma_unlock_write(vma->anon_vma);
	if (vma->vm_file)
		i_mmap_unlock_write(vma->vm_file->f_mapping);
}

99 100 101 102 103 104 105 106 107 108 109 110 111 112 113
static pte_t move_soft_dirty_pte(pte_t pte)
{
	/*
	 * Set soft dirty bit so we can notice
	 * in userspace the ptes were moved.
	 */
#ifdef CONFIG_MEM_SOFT_DIRTY
	if (pte_present(pte))
		pte = pte_mksoft_dirty(pte);
	else if (is_swap_pte(pte))
		pte = pte_swp_mksoft_dirty(pte);
#endif
	return pte;
}

114 115 116
static void move_ptes(struct vm_area_struct *vma, pmd_t *old_pmd,
		unsigned long old_addr, unsigned long old_end,
		struct vm_area_struct *new_vma, pmd_t *new_pmd,
117
		unsigned long new_addr, bool need_rmap_locks, bool *need_flush)
L
Linus Torvalds 已提交
118 119
{
	struct mm_struct *mm = vma->vm_mm;
120
	pte_t *old_pte, *new_pte, pte;
H
Hugh Dickins 已提交
121
	spinlock_t *old_ptl, *new_ptl;
122 123
	bool force_flush = false;
	unsigned long len = old_end - old_addr;
L
Linus Torvalds 已提交
124

125
	/*
126
	 * When need_rmap_locks is true, we take the i_mmap_rwsem and anon_vma
127 128 129 130 131 132 133 134 135 136 137 138 139 140 141 142
	 * locks to ensure that rmap will always observe either the old or the
	 * new ptes. This is the easiest way to avoid races with
	 * truncate_pagecache(), page migration, etc...
	 *
	 * When need_rmap_locks is false, we use other ways to avoid
	 * such races:
	 *
	 * - During exec() shift_arg_pages(), we use a specially tagged vma
	 *   which rmap call sites look for using is_vma_temporary_stack().
	 *
	 * - During mremap(), new_vma is often known to be placed after vma
	 *   in rmap traversal order. This ensures rmap will always observe
	 *   either the old pte, or the new pte, or both (the page table locks
	 *   serialize access to individual ptes, but only rmap traversal
	 *   order guarantees that we won't miss both the old and new ptes).
	 */
143 144
	if (need_rmap_locks)
		take_rmap_locks(vma);
L
Linus Torvalds 已提交
145

H
Hugh Dickins 已提交
146 147 148 149
	/*
	 * We don't have to worry about the ordering of src and dst
	 * pte locks because exclusive mmap_sem prevents deadlock.
	 */
H
Hugh Dickins 已提交
150
	old_pte = pte_offset_map_lock(mm, old_pmd, old_addr, &old_ptl);
P
Peter Zijlstra 已提交
151
	new_pte = pte_offset_map(new_pmd, new_addr);
H
Hugh Dickins 已提交
152 153
	new_ptl = pte_lockptr(mm, new_pmd);
	if (new_ptl != old_ptl)
I
Ingo Molnar 已提交
154
		spin_lock_nested(new_ptl, SINGLE_DEPTH_NESTING);
155
	flush_tlb_batched_pending(vma->vm_mm);
156
	arch_enter_lazy_mmu_mode();
157 158 159 160 161

	for (; old_addr < old_end; old_pte++, old_addr += PAGE_SIZE,
				   new_pte++, new_addr += PAGE_SIZE) {
		if (pte_none(*old_pte))
			continue;
162

163
		pte = ptep_get_and_clear(mm, old_addr, old_pte);
164
		/*
165 166
		 * If we are remapping a dirty PTE, make sure
		 * to flush TLB before we drop the PTL for the
167
		 * old PTE or we may race with page_mkclean().
168 169 170 171
		 *
		 * This check has to be done after we removed the
		 * old PTE from page tables or another thread may
		 * dirty it after the check and before the removal.
172
		 */
173
		if (pte_present(pte) && pte_dirty(pte))
174
			force_flush = true;
175
		pte = move_pte(pte, new_vma->vm_page_prot, old_addr, new_addr);
176 177
		pte = move_soft_dirty_pte(pte);
		set_pte_at(mm, new_addr, new_pte, pte);
L
Linus Torvalds 已提交
178
	}
179

180
	arch_leave_lazy_mmu_mode();
H
Hugh Dickins 已提交
181 182
	if (new_ptl != old_ptl)
		spin_unlock(new_ptl);
P
Peter Zijlstra 已提交
183
	pte_unmap(new_pte - 1);
184 185 186 187
	if (force_flush)
		flush_tlb_range(vma, old_end - len, old_end);
	else
		*need_flush = true;
H
Hugh Dickins 已提交
188
	pte_unmap_unlock(old_pte - 1, old_ptl);
189 190
	if (need_rmap_locks)
		drop_rmap_locks(vma);
L
Linus Torvalds 已提交
191 192
}

193 194
#define LATENCY_LIMIT	(64 * PAGE_SIZE)

195
unsigned long move_page_tables(struct vm_area_struct *vma,
L
Linus Torvalds 已提交
196
		unsigned long old_addr, struct vm_area_struct *new_vma,
197 198
		unsigned long new_addr, unsigned long len,
		bool need_rmap_locks)
L
Linus Torvalds 已提交
199
{
200 201
	unsigned long extent, next, old_end;
	pmd_t *old_pmd, *new_pmd;
202
	bool need_flush = false;
203 204
	unsigned long mmun_start;	/* For mmu_notifiers */
	unsigned long mmun_end;		/* For mmu_notifiers */
L
Linus Torvalds 已提交
205

206 207
	old_end = old_addr + len;
	flush_cache_range(vma, old_addr, old_end);
L
Linus Torvalds 已提交
208

209 210 211
	mmun_start = old_addr;
	mmun_end   = old_end;
	mmu_notifier_invalidate_range_start(vma->vm_mm, mmun_start, mmun_end);
212

213
	for (; old_addr < old_end; old_addr += extent, new_addr += extent) {
L
Linus Torvalds 已提交
214
		cond_resched();
215
		next = (old_addr + PMD_SIZE) & PMD_MASK;
216
		/* even if next overflowed, extent below will be ok */
217
		extent = next - old_addr;
218 219
		if (extent > old_end - old_addr)
			extent = old_end - old_addr;
220 221 222
		old_pmd = get_old_pmd(vma->vm_mm, old_addr);
		if (!old_pmd)
			continue;
223
		new_pmd = alloc_new_pmd(vma->vm_mm, vma, new_addr);
224 225
		if (!new_pmd)
			break;
226
		if (pmd_trans_huge(*old_pmd)) {
227
			if (extent == HPAGE_PMD_SIZE) {
228
				bool moved;
229 230
				/* See comment in move_ptes() */
				if (need_rmap_locks)
231
					take_rmap_locks(vma);
232
				moved = move_huge_pmd(vma, old_addr, new_addr,
233 234
						    old_end, old_pmd, new_pmd,
						    &need_flush);
235
				if (need_rmap_locks)
236
					drop_rmap_locks(vma);
237
				if (moved)
238
					continue;
239
			}
240
			split_huge_pmd(vma, old_pmd, old_addr);
241
			if (pmd_trans_unstable(old_pmd))
242
				continue;
243
		}
244
		if (pte_alloc(new_vma->vm_mm, new_pmd, new_addr))
245
			break;
246 247 248 249 250
		next = (new_addr + PMD_SIZE) & PMD_MASK;
		if (extent > next - new_addr)
			extent = next - new_addr;
		if (extent > LATENCY_LIMIT)
			extent = LATENCY_LIMIT;
251 252
		move_ptes(vma, old_pmd, old_addr, old_addr + extent, new_vma,
			  new_pmd, new_addr, need_rmap_locks, &need_flush);
L
Linus Torvalds 已提交
253
	}
254
	if (need_flush)
255 256
		flush_tlb_range(vma, old_end-len, old_addr);

257
	mmu_notifier_invalidate_range_end(vma->vm_mm, mmun_start, mmun_end);
258 259

	return len + old_addr - old_end;	/* how much done */
L
Linus Torvalds 已提交
260 261 262 263
}

static unsigned long move_vma(struct vm_area_struct *vma,
		unsigned long old_addr, unsigned long old_len,
264
		unsigned long new_len, unsigned long new_addr,
265 266
		bool *locked, struct vm_userfaultfd_ctx *uf,
		struct list_head *uf_unmap)
L
Linus Torvalds 已提交
267 268 269 270 271 272 273
{
	struct mm_struct *mm = vma->vm_mm;
	struct vm_area_struct *new_vma;
	unsigned long vm_flags = vma->vm_flags;
	unsigned long new_pgoff;
	unsigned long moved_len;
	unsigned long excess = 0;
274
	unsigned long hiwater_vm;
L
Linus Torvalds 已提交
275
	int split = 0;
276
	int err;
277
	bool need_rmap_locks;
L
Linus Torvalds 已提交
278 279 280 281 282 283 284 285

	/*
	 * We'd prefer to avoid failure later on in do_munmap:
	 * which may split one vma into three before unmapping.
	 */
	if (mm->map_count >= sysctl_max_map_count - 3)
		return -ENOMEM;

286 287 288 289 290 291 292
	/*
	 * Advise KSM to break any KSM pages in the area to be moved:
	 * it would be confusing if they were to turn up at the new
	 * location, where they happen to coincide with different KSM
	 * pages recently unmapped.  But leave vma->vm_flags as it was,
	 * so KSM can come around to merge on vma and new_vma afterwards.
	 */
293 294 295 296
	err = ksm_madvise(vma, old_addr, old_addr + old_len,
						MADV_UNMERGEABLE, &vm_flags);
	if (err)
		return err;
297

L
Linus Torvalds 已提交
298
	new_pgoff = vma->vm_pgoff + ((old_addr - vma->vm_start) >> PAGE_SHIFT);
299 300
	new_vma = copy_vma(&vma, new_addr, new_len, new_pgoff,
			   &need_rmap_locks);
L
Linus Torvalds 已提交
301 302 303
	if (!new_vma)
		return -ENOMEM;

304 305
	moved_len = move_page_tables(vma, old_addr, new_vma, new_addr, old_len,
				     need_rmap_locks);
L
Linus Torvalds 已提交
306
	if (moved_len < old_len) {
307
		err = -ENOMEM;
308 309
	} else if (vma->vm_ops && vma->vm_ops->mremap) {
		err = vma->vm_ops->mremap(new_vma);
310 311 312
	}

	if (unlikely(err)) {
L
Linus Torvalds 已提交
313 314 315 316 317
		/*
		 * On error, move entries back from new area to old,
		 * which will succeed since page tables still there,
		 * and then proceed to unmap new area instead of old.
		 */
318 319
		move_page_tables(new_vma, new_addr, vma, old_addr, moved_len,
				 true);
L
Linus Torvalds 已提交
320 321 322
		vma = new_vma;
		old_len = new_len;
		old_addr = new_addr;
323
		new_addr = err;
L
Laurent Dufour 已提交
324
	} else {
325
		mremap_userfaultfd_prep(new_vma, uf);
L
Laurent Dufour 已提交
326 327
		arch_remap(mm, old_addr, old_addr + old_len,
			   new_addr, new_addr + new_len);
A
Al Viro 已提交
328
	}
L
Linus Torvalds 已提交
329 330 331 332 333 334 335 336 337 338

	/* Conceal VM_ACCOUNT so old reservation is not undone */
	if (vm_flags & VM_ACCOUNT) {
		vma->vm_flags &= ~VM_ACCOUNT;
		excess = vma->vm_end - vma->vm_start - old_len;
		if (old_addr > vma->vm_start &&
		    old_addr + old_len < vma->vm_end)
			split = 1;
	}

K
Kirill Korotaev 已提交
339
	/*
340 341 342 343 344 345 346
	 * If we failed to move page tables we still do total_vm increment
	 * since do_munmap() will decrement it by old_len == new_len.
	 *
	 * Since total_vm is about to be raised artificially high for a
	 * moment, we need to restore high watermark afterwards: if stats
	 * are taken meanwhile, total_vm and hiwater_vm appear too high.
	 * If this were a serious issue, we'd add a flag to do_munmap().
K
Kirill Korotaev 已提交
347
	 */
348
	hiwater_vm = mm->hiwater_vm;
349
	vm_stat_account(mm, vma->vm_flags, new_len >> PAGE_SHIFT);
K
Kirill Korotaev 已提交
350

351 352 353 354
	/* Tell pfnmap has moved from this vma */
	if (unlikely(vma->vm_flags & VM_PFNMAP))
		untrack_pfn_moved(vma);

355
	if (do_munmap(mm, old_addr, old_len, uf_unmap) < 0) {
L
Linus Torvalds 已提交
356 357 358 359
		/* OOM: unable to split vma, just get accounts right */
		vm_unacct_memory(excess >> PAGE_SHIFT);
		excess = 0;
	}
360
	mm->hiwater_vm = hiwater_vm;
L
Linus Torvalds 已提交
361 362 363 364 365 366 367 368 369 370

	/* Restore VM_ACCOUNT if one or two pieces of vma left */
	if (excess) {
		vma->vm_flags |= VM_ACCOUNT;
		if (split)
			vma->vm_next->vm_flags |= VM_ACCOUNT;
	}

	if (vm_flags & VM_LOCKED) {
		mm->locked_vm += new_len >> PAGE_SHIFT;
371
		*locked = true;
L
Linus Torvalds 已提交
372 373 374 375 376
	}

	return new_addr;
}

A
Al Viro 已提交
377 378 379 380 381
static struct vm_area_struct *vma_to_resize(unsigned long addr,
	unsigned long old_len, unsigned long new_len, unsigned long *p)
{
	struct mm_struct *mm = current->mm;
	struct vm_area_struct *vma = find_vma(mm, addr);
382
	unsigned long pgoff;
A
Al Viro 已提交
383 384

	if (!vma || vma->vm_start > addr)
385
		return ERR_PTR(-EFAULT);
A
Al Viro 已提交
386 387

	if (is_vm_hugetlb_page(vma))
388
		return ERR_PTR(-EINVAL);
A
Al Viro 已提交
389 390 391

	/* We can't remap across vm area boundaries */
	if (old_len > vma->vm_end - addr)
392
		return ERR_PTR(-EFAULT);
A
Al Viro 已提交
393

394 395 396
	if (new_len == old_len)
		return vma;

397
	/* Need to be careful about a growing mapping */
398 399 400 401 402 403 404
	pgoff = (addr - vma->vm_start) >> PAGE_SHIFT;
	pgoff += vma->vm_pgoff;
	if (pgoff + (new_len >> PAGE_SHIFT) < pgoff)
		return ERR_PTR(-EINVAL);

	if (vma->vm_flags & (VM_DONTEXPAND | VM_PFNMAP))
		return ERR_PTR(-EFAULT);
A
Al Viro 已提交
405 406 407 408

	if (vma->vm_flags & VM_LOCKED) {
		unsigned long locked, lock_limit;
		locked = mm->locked_vm << PAGE_SHIFT;
J
Jiri Slaby 已提交
409
		lock_limit = rlimit(RLIMIT_MEMLOCK);
A
Al Viro 已提交
410 411
		locked += new_len - old_len;
		if (locked > lock_limit && !capable(CAP_IPC_LOCK))
412
			return ERR_PTR(-EAGAIN);
A
Al Viro 已提交
413 414
	}

415 416
	if (!may_expand_vm(mm, vma->vm_flags,
				(new_len - old_len) >> PAGE_SHIFT))
417
		return ERR_PTR(-ENOMEM);
A
Al Viro 已提交
418 419 420

	if (vma->vm_flags & VM_ACCOUNT) {
		unsigned long charged = (new_len - old_len) >> PAGE_SHIFT;
421
		if (security_vm_enough_memory_mm(mm, charged))
422
			return ERR_PTR(-ENOMEM);
A
Al Viro 已提交
423 424 425 426 427 428
		*p = charged;
	}

	return vma;
}

429
static unsigned long mremap_to(unsigned long addr, unsigned long old_len,
430
		unsigned long new_addr, unsigned long new_len, bool *locked,
431
		struct vm_userfaultfd_ctx *uf,
432
		struct list_head *uf_unmap_early,
433
		struct list_head *uf_unmap)
A
Al Viro 已提交
434 435 436 437 438
{
	struct mm_struct *mm = current->mm;
	struct vm_area_struct *vma;
	unsigned long ret = -EINVAL;
	unsigned long charged = 0;
A
Al Viro 已提交
439
	unsigned long map_flags;
A
Al Viro 已提交
440

441
	if (offset_in_page(new_addr))
A
Al Viro 已提交
442 443 444 445 446
		goto out;

	if (new_len > TASK_SIZE || new_addr > TASK_SIZE - new_len)
		goto out;

447 448
	/* Ensure the old/new locations do not overlap */
	if (addr + old_len > new_addr && new_addr + new_len > addr)
A
Al Viro 已提交
449 450
		goto out;

451
	ret = do_munmap(mm, new_addr, new_len, uf_unmap_early);
A
Al Viro 已提交
452 453 454 455
	if (ret)
		goto out;

	if (old_len >= new_len) {
456
		ret = do_munmap(mm, addr+new_len, old_len - new_len, uf_unmap);
A
Al Viro 已提交
457 458 459 460 461 462 463 464 465 466 467
		if (ret && old_len != new_len)
			goto out;
		old_len = new_len;
	}

	vma = vma_to_resize(addr, old_len, new_len, &charged);
	if (IS_ERR(vma)) {
		ret = PTR_ERR(vma);
		goto out;
	}

A
Al Viro 已提交
468 469 470
	map_flags = MAP_FIXED;
	if (vma->vm_flags & VM_MAYSHARE)
		map_flags |= MAP_SHARED;
471

A
Al Viro 已提交
472 473 474
	ret = get_unmapped_area(vma->vm_file, new_addr, new_len, vma->vm_pgoff +
				((addr - vma->vm_start) >> PAGE_SHIFT),
				map_flags);
475
	if (offset_in_page(ret))
A
Al Viro 已提交
476 477
		goto out1;

478 479
	ret = move_vma(vma, addr, old_len, new_len, new_addr, locked, uf,
		       uf_unmap);
480
	if (!(offset_in_page(ret)))
A
Al Viro 已提交
481 482 483
		goto out;
out1:
	vm_unacct_memory(charged);
A
Al Viro 已提交
484 485 486 487 488

out:
	return ret;
}

A
Al Viro 已提交
489 490
static int vma_expandable(struct vm_area_struct *vma, unsigned long delta)
{
A
Al Viro 已提交
491
	unsigned long end = vma->vm_end + delta;
492
	if (end < vma->vm_end) /* overflow */
A
Al Viro 已提交
493
		return 0;
494
	if (vma->vm_next && vma->vm_next->vm_start < end) /* intersection */
A
Al Viro 已提交
495 496 497
		return 0;
	if (get_unmapped_area(NULL, vma->vm_start, end - vma->vm_start,
			      0, MAP_FIXED) & ~PAGE_MASK)
A
Al Viro 已提交
498 499 500 501
		return 0;
	return 1;
}

L
Linus Torvalds 已提交
502 503 504 505 506 507 508
/*
 * Expand (or shrink) an existing mapping, potentially moving it at the
 * same time (controlled by the MREMAP_MAYMOVE flag and available VM space)
 *
 * MREMAP_FIXED option added 5-Dec-1999 by Benjamin LaHaise
 * This option implies MREMAP_MAYMOVE.
 */
A
Al Viro 已提交
509 510 511
SYSCALL_DEFINE5(mremap, unsigned long, addr, unsigned long, old_len,
		unsigned long, new_len, unsigned long, flags,
		unsigned long, new_addr)
L
Linus Torvalds 已提交
512
{
H
Hugh Dickins 已提交
513
	struct mm_struct *mm = current->mm;
L
Linus Torvalds 已提交
514 515 516
	struct vm_area_struct *vma;
	unsigned long ret = -EINVAL;
	unsigned long charged = 0;
517
	bool locked = false;
518
	struct vm_userfaultfd_ctx uf = NULL_VM_UFFD_CTX;
519
	LIST_HEAD(uf_unmap_early);
520
	LIST_HEAD(uf_unmap);
L
Linus Torvalds 已提交
521 522

	if (flags & ~(MREMAP_FIXED | MREMAP_MAYMOVE))
523 524 525 526
		return ret;

	if (flags & MREMAP_FIXED && !(flags & MREMAP_MAYMOVE))
		return ret;
L
Linus Torvalds 已提交
527

528
	if (offset_in_page(addr))
529
		return ret;
L
Linus Torvalds 已提交
530 531 532 533 534 535 536 537 538 539

	old_len = PAGE_ALIGN(old_len);
	new_len = PAGE_ALIGN(new_len);

	/*
	 * We allow a zero old-len as a special case
	 * for DOS-emu "duplicate shm area" thing. But
	 * a zero new-len is nonsensical.
	 */
	if (!new_len)
540 541
		return ret;

542 543
	if (down_write_killable(&current->mm->mmap_sem))
		return -EINTR;
L
Linus Torvalds 已提交
544 545

	if (flags & MREMAP_FIXED) {
546
		ret = mremap_to(addr, old_len, new_addr, new_len,
547
				&locked, &uf, &uf_unmap_early, &uf_unmap);
A
Al Viro 已提交
548
		goto out;
L
Linus Torvalds 已提交
549 550 551 552 553 554 555 556
	}

	/*
	 * Always allow a shrinking remap: that just unmaps
	 * the unnecessary pages..
	 * do_munmap does all the needed commit accounting
	 */
	if (old_len >= new_len) {
557
		ret = do_munmap(mm, addr+new_len, old_len - new_len, &uf_unmap);
L
Linus Torvalds 已提交
558 559 560
		if (ret && old_len != new_len)
			goto out;
		ret = addr;
A
Al Viro 已提交
561
		goto out;
L
Linus Torvalds 已提交
562 563 564
	}

	/*
A
Al Viro 已提交
565
	 * Ok, we need to grow..
L
Linus Torvalds 已提交
566
	 */
A
Al Viro 已提交
567 568 569
	vma = vma_to_resize(addr, old_len, new_len, &charged);
	if (IS_ERR(vma)) {
		ret = PTR_ERR(vma);
L
Linus Torvalds 已提交
570
		goto out;
A
akpm@osdl.org 已提交
571
	}
L
Linus Torvalds 已提交
572 573 574

	/* old_len exactly to the end of the area..
	 */
A
Al Viro 已提交
575
	if (old_len == vma->vm_end - addr) {
L
Linus Torvalds 已提交
576
		/* can we just expand the current mapping? */
A
Al Viro 已提交
577
		if (vma_expandable(vma, new_len - old_len)) {
L
Linus Torvalds 已提交
578 579
			int pages = (new_len - old_len) >> PAGE_SHIFT;

580 581 582 583 584
			if (vma_adjust(vma, vma->vm_start, addr + new_len,
				       vma->vm_pgoff, NULL)) {
				ret = -ENOMEM;
				goto out;
			}
L
Linus Torvalds 已提交
585

586
			vm_stat_account(mm, vma->vm_flags, pages);
L
Linus Torvalds 已提交
587
			if (vma->vm_flags & VM_LOCKED) {
H
Hugh Dickins 已提交
588
				mm->locked_vm += pages;
589 590
				locked = true;
				new_addr = addr;
L
Linus Torvalds 已提交
591 592 593 594 595 596 597 598 599 600 601 602
			}
			ret = addr;
			goto out;
		}
	}

	/*
	 * We weren't able to just expand or shrink the area,
	 * we need to create a new one and move it..
	 */
	ret = -ENOMEM;
	if (flags & MREMAP_MAYMOVE) {
A
Al Viro 已提交
603 604 605 606 607
		unsigned long map_flags = 0;
		if (vma->vm_flags & VM_MAYSHARE)
			map_flags |= MAP_SHARED;

		new_addr = get_unmapped_area(vma->vm_file, 0, new_len,
608 609 610
					vma->vm_pgoff +
					((addr - vma->vm_start) >> PAGE_SHIFT),
					map_flags);
611
		if (offset_in_page(new_addr)) {
A
Al Viro 已提交
612 613
			ret = new_addr;
			goto out;
L
Linus Torvalds 已提交
614
		}
A
Al Viro 已提交
615

616
		ret = move_vma(vma, addr, old_len, new_len, new_addr,
617
			       &locked, &uf, &uf_unmap);
L
Linus Torvalds 已提交
618 619
	}
out:
620
	if (offset_in_page(ret)) {
L
Linus Torvalds 已提交
621
		vm_unacct_memory(charged);
622 623
		locked = 0;
	}
L
Linus Torvalds 已提交
624
	up_write(&current->mm->mmap_sem);
625 626
	if (locked && new_len > old_len)
		mm_populate(new_addr + old_len, new_len - old_len);
627
	userfaultfd_unmap_complete(mm, &uf_unmap_early);
628
	mremap_userfaultfd_complete(&uf, addr, new_addr, old_len);
629
	userfaultfd_unmap_complete(mm, &uf_unmap);
L
Linus Torvalds 已提交
630 631
	return ret;
}