[patches] VM-related fixes

[Al Viro <viro@ZenIV.linux.org.uk>]

	I'd been crawling through VMA-related code for the last couple
of weeks; the obvious parts of fallout are in followups and IMO they
need to go into -stable as well; there's more, including some bugs I
don't know what to do about and patches that need more testing...

* aout handling needs to do setup_arg_pages() _before_ it does any mmap();
otherwise we might easily end up with bprm->vma freed by the time we
get to setup_arg_pages().  Sure, long-term we want setup_new_exec()
merged with setup_arg_pages(), but not this late in the cycle...

* anonymous shared mapping should *not* get VM_GROWS{UP,DOWN}, or we'll
end up with very unpleasant things happening.

* __unmap_hugepage_range() calls flush_tlb_range() without ->mmap_sem,
which means that we need ->page_table_lock.  Call it before dropping
->page_table_lock, not after that...

[unsolved] binder is insane, even more than usual for drivers/staging.
It stores a reference to mm at open() time, then it stores a reference to
vma at mmap() time, then it cheerfully works with that ->vma assuming that
->mmap_sem on stored reference to ->mm would suffice.  Guess what happens
if somebody opens it and then forks and does mmap in child?  Moreover, if
we fork() and have child exit(), we get ->close() called on each VMA we'd
copied into child.  Since they have stored reference to vma invalidated by
->close(), that has unpleasant side effects, to put it mildly.  And yes,
I realize that android userland probably doesn't do anything of that kind;
fat lot of good it does us...

[unsolved] a bunch of ->fault() instances are doing things that need
->mmap_sem exclusive; e.g. vm_insert_page() is called by xip_file_fault(),
drivers/misc/sgi-gru/grumain.c:gru_fault() does remap_pfn_range().
drivers/gpu/drm/gma500/framebuffer.c:psbfb_vm_fault() does
        vma->vm_page_prot = pgprot_noncached(vma->vm_page_prot);
and drivers/gpu/drm/ttm/ttm_bo_vm.c:ttm_bo_vm_fault() does very similar
things, same for spufs ->fault() instances.