From: Hugh Dickins <hu...@google.com> commit f4cb767d76cf7ee72f97dd76f6cfa6c76a5edc89 upstream
Trinity gets kernel BUG at mm/mmap.c:1963! in about 3 minutes of mmap testing. That's the VM_BUG_ON(gap_end < gap_start) at the end of unmapped_area_topdown(). Linus points out how MAP_FIXED (which does not have to respect our stack guard gap intentions) could result in gap_end below gap_start there. Fix that, and the similar case in its alternative, unmapped_area(). Cc: sta...@vger.kernel.org Fixes: 1be7107fbe18 ("mm: larger stack guard gap, between vmas") Reported-by: Dave Jones <da...@codemonkey.org.uk> Debugged-by: Linus Torvalds <torva...@linux-foundation.org> Signed-off-by: Hugh Dickins <hu...@google.com> Acked-by: Michal Hocko <mho...@suse.com> Signed-off-by: Linus Torvalds <torva...@linux-foundation.org> Signed-off-by: Jianchuan Wang <jianchuan.w...@windriver.com> --- mm/mmap.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/mm/mmap.c b/mm/mmap.c index 945ff3b..91581c6 100644 --- a/mm/mmap.c +++ b/mm/mmap.c @@ -1814,7 +1814,8 @@ unsigned long unmapped_area(struct vm_unmapped_area_info *info) /* Check if current node has a suitable gap */ if (gap_start > high_limit) return -ENOMEM; - if (gap_end >= low_limit && gap_end - gap_start >= length) + if (gap_end >= low_limit && + gap_end > gap_start && gap_end - gap_start >= length) goto found; /* Visit right subtree if it looks promising */ @@ -1917,7 +1918,8 @@ unsigned long unmapped_area_topdown(struct vm_unmapped_area_info *info) gap_end = vm_start_gap(vma); if (gap_end < low_limit) return -ENOMEM; - if (gap_start <= high_limit && gap_end - gap_start >= length) + if (gap_start <= high_limit && + gap_end > gap_start && gap_end - gap_start >= length) goto found; /* Visit left subtree if it looks promising */ -- 2.8.1 -- _______________________________________________ linux-yocto mailing list linux-yo...@yoctoproject.org https://lists.yoctoproject.org/listinfo/linux-yocto