|
@@ -2230,16 +2230,19 @@ int expand_upwards(struct vm_area_struct *vma, unsigned long address)
|
|
|
if (!(vma->vm_flags & VM_GROWSUP))
|
|
|
return -EFAULT;
|
|
|
|
|
|
- /* Guard against wrapping around to address 0. */
|
|
|
+ /* Guard against exceeding limits of the address space. */
|
|
|
address &= PAGE_MASK;
|
|
|
- address += PAGE_SIZE;
|
|
|
- if (!address)
|
|
|
+ if (address >= TASK_SIZE)
|
|
|
return -ENOMEM;
|
|
|
+ address += PAGE_SIZE;
|
|
|
|
|
|
/* Enforce stack_guard_gap */
|
|
|
gap_addr = address + stack_guard_gap;
|
|
|
- if (gap_addr < address)
|
|
|
- return -ENOMEM;
|
|
|
+
|
|
|
+ /* Guard against overflow */
|
|
|
+ if (gap_addr < address || gap_addr > TASK_SIZE)
|
|
|
+ gap_addr = TASK_SIZE;
|
|
|
+
|
|
|
next = vma->vm_next;
|
|
|
if (next && next->vm_start < gap_addr) {
|
|
|
if (!(next->vm_flags & VM_GROWSUP))
|