Re: [PATCH] mm: larger stack guard gap, between vmas

Re: [PATCH] mm: larger stack guard gap, between vmas

[Ben Hutchings]

[-- Attachment #1: Type: text/plain, Size: 42391 bytes --]

Here's my attempt at a backport to 3.2.  This is only tested on
x86_64 and I think I should introduce local variables for
vma_start_gap() in a few places.  I had to cherry-pick commit
09884964335e "mm: do not grow the stack vma just because of an overrun
on preceding vma" before this one (which was a clean cherry-pick).

Ben.

---
From: Hugh Dickins <hughd@google.com>
Date: Mon, 19 Jun 2017 20:32:47 +0200
Subject: mm: larger stack guard gap, between vmas

commit 1be7107fbe18eed3e319a6c3e83c78254b693acb upstream.

Stack guard page is a useful feature to reduce a risk of stack smashing
into a different mapping. We have been using a single page gap which
is sufficient to prevent having stack adjacent to a different mapping.
But this seems to be insufficient in the light of the stack usage in
userspace. E.g. glibc uses as large as 64kB alloca() in many commonly
used functions. Others use constructs liks gid_t buffer[NGROUPS_MAX]
which is 256kB or stack strings with MAX_ARG_STRLEN.

This will become especially dangerous for suid binaries and the default
no limit for the stack size limit because those applications can be
tricked to consume a large portion of the stack and a single glibc call
could jump over the guard page. These attacks are not theoretical,
unfortunatelly.

Make those attacks less probable by increasing the stack guard gap
to 1MB (on systems with 4k pages; but make it depend on the page size
because systems with larger base pages might cap stack allocations in
the PAGE_SIZE units) which should cover larger alloca() and VLA stack
allocations. It is obviously not a full fix because the problem is
somehow inherent, but it should reduce attack space a lot.

One could argue that the gap size should be configurable from userspace,
but that can be done later when somebody finds that the new 1MB is wrong
for some special case applications.  For now, add a kernel command line
option (stack_guard_gap) to specify the stack gap size (in page units).

Implementation wise, first delete all the old code for stack guard page:
because although we could get away with accounting one extra page in a
stack vma, accounting a larger gap can break userspace - case in point,
a program run with "ulimit -S -v 20000" failed when the 1MB gap was
counted for RLIMIT_AS; similar problems could come with RLIMIT_MLOCK
and strict non-overcommit mode.

Instead of keeping gap inside the stack vma, maintain the stack guard
gap as a gap between vmas: using vm_start_gap() in place of vm_start
(or vm_end_gap() in place of vm_end if VM_GROWSUP) in just those few
places which need to respect the gap - mainly arch_get_unmapped_area(),
and and the vma tree's subtree_gap support for that.

Original-patch-by: Oleg Nesterov <oleg@redhat.com>
Original-patch-by: Michal Hocko <mhocko@suse.com>
Signed-off-by: Hugh Dickins <hughd@google.com>
[wt: backport to 4.11: adjust context]
[wt: backport to 4.9: adjust context ; kernel doc was not in admin-guide]
[wt: backport to 4.4: adjust context ; drop ppc hugetlb_radix changes]
[wt: backport to 3.18: adjust context ; no FOLL_POPULATE ;
     s390 uses generic arch_get_unmapped_area()]
[wt: backport to 3.16: adjust context]
[wt: backport to 3.10: adjust context ; code logic in PARISC's
     arch_get_unmapped_area() wasn't found ; code inserted into
     expand_upwards() and expand_downwards() runs under anon_vma lock;
     changes for gup.c:faultin_page go to memory.c:__get_user_pages()]
Signed-off-by: Willy Tarreau <w@1wt.eu>
---
Some of these suggested adjustments below are just what comparing mine
and yours showed up, and I'm being anal in passing them on e.g. I do
like your blank line in mm.h, but Michal chose to leave it out, and
I think that the closer we keep these sources to each other,
the less trouble we shall have patching on top in future.

Hugh.
---
[bwh: Backported to 3.2:
 - Drop changes for arc (doesn't exist here), xtensa (doesn't implement
   arch_get_unmapped_area() here)
 - There's no rb_subtree_gap, so patch the loop in each
   arch_get_unmapped_area{,_topdown}()
 - Adjust context]
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
--- a/Documentation/kernel-parameters.txt
+++ b/Documentation/kernel-parameters.txt
@@ -2463,6 +2463,13 @@ bytes respectively. Such letter suffixes
 	spia_pedr=
 	spia_peddr=
 
+	stack_guard_gap=	[MM]
+			override the default stack gap protection. The value
+			is in page units and it defines how many pages prior
+			to (for stacks growing down) resp. after (for stacks
+			growing up) the main stack are reserved for no other
+			mapping. Default value is 256 pages.
+
 	stacktrace	[FTRACE]
 			Enabled the stack tracer on boot up.
 
--- a/arch/arm/mm/mmap.c
+++ b/arch/arm/mm/mmap.c
@@ -101,7 +101,7 @@ arch_get_unmapped_area(struct file *filp
 
 		vma = find_vma(mm, addr);
 		if (TASK_SIZE - len >= addr &&
-		    (!vma || addr + len <= vma->vm_start))
+		    (!vma || addr + len <= vm_start_gap(vma)))
 			return addr;
 	}
 	if (len > mm->cached_hole_size) {
@@ -131,15 +131,15 @@ full_search:
 			}
 			return -ENOMEM;
 		}
-		if (!vma || addr + len <= vma->vm_start) {
+		if (!vma || addr + len <= vm_start_gap(vma)) {
 			/*
 			 * Remember the place where we stopped the search:
 			 */
 			mm->free_area_cache = addr + len;
 			return addr;
 		}
-		if (addr + mm->cached_hole_size < vma->vm_start)
-		        mm->cached_hole_size = vma->vm_start - addr;
+		if (addr + mm->cached_hole_size < vm_start_gap(vma))
+		        mm->cached_hole_size = vm_start_gap(vma) - addr;
 		addr = vma->vm_end;
 		if (do_align)
 			addr = COLOUR_ALIGN(addr, pgoff);
@@ -183,7 +183,7 @@ arch_get_unmapped_area_topdown(struct fi
 			addr = PAGE_ALIGN(addr);
 		vma = find_vma(mm, addr);
 		if (TASK_SIZE - len >= addr &&
-				(!vma || addr + len <= vma->vm_start))
+				(!vma || addr + len <= vm_start_gap(vma)))
 			return addr;
 	}
 
@@ -222,19 +222,19 @@ arch_get_unmapped_area_topdown(struct fi
 		 * return with success:
 		 */
 		vma = find_vma(mm, addr);
-		if (!vma || addr+len <= vma->vm_start)
+		if (!vma || addr + len <= vm_start_gap(vma))
 			/* remember the address as a hint for next time */
 			return (mm->free_area_cache = addr);
 
 		/* remember the largest hole we saw so far */
-		if (addr + mm->cached_hole_size < vma->vm_start)
-			mm->cached_hole_size = vma->vm_start - addr;
+		if (addr + mm->cached_hole_size < vm_start_gap(vma))
+			mm->cached_hole_size = vm_start_gap(vma) - addr;
 
 		/* try just below the current vma->vm_start */
-		addr = vma->vm_start - len;
+		addr = vm_start_gap(vma) - len;
 		if (do_align)
 			addr = COLOUR_ALIGN_DOWN(addr, pgoff);
-	} while (len < vma->vm_start);
+	} while (len < vm_start_gap(vma));
 
 bottomup:
 	/*
--- a/arch/frv/mm/elf-fdpic.c
+++ b/arch/frv/mm/elf-fdpic.c
@@ -74,7 +74,7 @@ unsigned long arch_get_unmapped_area(str
 		addr = PAGE_ALIGN(addr);
 		vma = find_vma(current->mm, addr);
 		if (TASK_SIZE - len >= addr &&
-		    (!vma || addr + len <= vma->vm_start))
+		    (!vma || addr + len <= vm_start_gap(vma)))
 			goto success;
 	}
 
@@ -89,7 +89,7 @@ unsigned long arch_get_unmapped_area(str
 			for (; vma; vma = vma->vm_next) {
 				if (addr > limit)
 					break;
-				if (addr + len <= vma->vm_start)
+				if (addr + len <= vm_start_gap(vma))
 					goto success;
 				addr = vma->vm_end;
 			}
@@ -104,7 +104,7 @@ unsigned long arch_get_unmapped_area(str
 		for (; vma; vma = vma->vm_next) {
 			if (addr > limit)
 				break;
-			if (addr + len <= vma->vm_start)
+			if (addr + len <= vm_start_gap(vma))
 				goto success;
 			addr = vma->vm_end;
 		}
--- a/arch/ia64/kernel/sys_ia64.c
+++ b/arch/ia64/kernel/sys_ia64.c
@@ -27,7 +27,7 @@ arch_get_unmapped_area (struct file *fil
 	long map_shared = (flags & MAP_SHARED);
 	unsigned long start_addr, align_mask = PAGE_SIZE - 1;
 	struct mm_struct *mm = current->mm;
-	struct vm_area_struct *vma;
+	struct vm_area_struct *vma, *prev;
 
 	if (len > RGN_MAP_LIMIT)
 		return -ENOMEM;
@@ -58,7 +58,7 @@ arch_get_unmapped_area (struct file *fil
   full_search:
 	start_addr = addr = (addr + align_mask) & ~align_mask;
 
-	for (vma = find_vma(mm, addr); ; vma = vma->vm_next) {
+	for (vma = find_vma_prev(mm, addr, &prev); ; vma = vma->vm_next) {
 		/* At this point:  (!vma || addr < vma->vm_end). */
 		if (TASK_SIZE - len < addr || RGN_MAP_LIMIT - len < REGION_OFFSET(addr)) {
 			if (start_addr != TASK_UNMAPPED_BASE) {
@@ -68,12 +68,13 @@ arch_get_unmapped_area (struct file *fil
 			}
 			return -ENOMEM;
 		}
-		if (!vma || addr + len <= vma->vm_start) {
+		if ((!vma || addr + len <= vm_start_gap(vma)) &&
+		    (!prev || addr >= vm_end_gap(prev))) {
 			/* Remember the address where we stopped this search:  */
 			mm->free_area_cache = addr + len;
 			return addr;
 		}
-		addr = (vma->vm_end + align_mask) & ~align_mask;
+		addr = (vm_end_gap(vma) + align_mask) & ~align_mask;
 	}
 }
 
--- a/arch/mips/mm/mmap.c
+++ b/arch/mips/mm/mmap.c
@@ -103,7 +103,7 @@ static unsigned long arch_get_unmapped_a
 
 		vma = find_vma(mm, addr);
 		if (TASK_SIZE - len >= addr &&
-		    (!vma || addr + len <= vma->vm_start))
+		    (!vma || addr + len <= vm_start_gap(vma)))
 			return addr;
 	}
 
@@ -118,7 +118,7 @@ static unsigned long arch_get_unmapped_a
 			/* At this point:  (!vma || addr < vma->vm_end). */
 			if (TASK_SIZE - len < addr)
 				return -ENOMEM;
-			if (!vma || addr + len <= vma->vm_start)
+			if (!vma || addr + len <= vm_start_gap(vma))
 				return addr;
 			addr = vma->vm_end;
 			if (do_color_align)
@@ -145,7 +145,7 @@ static unsigned long arch_get_unmapped_a
 		/* make sure it can fit in the remaining address space */
 		if (likely(addr > len)) {
 			vma = find_vma(mm, addr - len);
-			if (!vma || addr <= vma->vm_start) {
+			if (!vma || addr <= vm_start_gap(vma)) {
 				/* cache the address as a hint for next time */
 				return mm->free_area_cache = addr - len;
 			}
@@ -165,20 +165,20 @@ static unsigned long arch_get_unmapped_a
 			 * return with success:
 			 */
 			vma = find_vma(mm, addr);
-			if (likely(!vma || addr + len <= vma->vm_start)) {
+			if (likely(!vma || addr + len <= vm_start_gap(vma))) {
 				/* cache the address as a hint for next time */
 				return mm->free_area_cache = addr;
 			}
 
 			/* remember the largest hole we saw so far */
-			if (addr + mm->cached_hole_size < vma->vm_start)
-				mm->cached_hole_size = vma->vm_start - addr;
+			if (addr + mm->cached_hole_size < vm_start_gap(vma))
+				mm->cached_hole_size = vm_start_gap(vma) - addr;
 
 			/* try just below the current vma->vm_start */
 			addr = vma->vm_start - len;
 			if (do_color_align)
 				addr = COLOUR_ALIGN_DOWN(addr, pgoff);
-		} while (likely(len < vma->vm_start));
+		} while (likely(len < vm_start_gap(vma)));
 
 bottomup:
 		/*
--- a/arch/parisc/kernel/sys_parisc.c
+++ b/arch/parisc/kernel/sys_parisc.c
@@ -35,17 +35,18 @@
 
 static unsigned long get_unshared_area(unsigned long addr, unsigned long len)
 {
-	struct vm_area_struct *vma;
+	struct vm_area_struct *vma, *prev;
 
 	addr = PAGE_ALIGN(addr);
 
-	for (vma = find_vma(current->mm, addr); ; vma = vma->vm_next) {
+	for (vma = find_vma_prev(current->mm, addr, &prev); ; vma = vma->vm_next) {
 		/* At this point:  (!vma || addr < vma->vm_end). */
 		if (TASK_SIZE - len < addr)
 			return -ENOMEM;
-		if (!vma || addr + len <= vma->vm_start)
+		if ((!vma || addr + len <= vma->vm_start) &&
+		    (!prev || addr >= vm_end_gap(prev)))
 			return addr;
-		addr = vma->vm_end;
+		addr = vm_end_gap(vma);
 	}
 }
 
@@ -70,21 +71,22 @@ static int get_offset(struct address_spa
 static unsigned long get_shared_area(struct address_space *mapping,
 		unsigned long addr, unsigned long len, unsigned long pgoff)
 {
-	struct vm_area_struct *vma;
+	struct vm_area_struct *vma, *prev;
 	int offset = mapping ? get_offset(mapping) : 0;
 
 	offset = (offset + (pgoff << PAGE_SHIFT)) & 0x3FF000;
 
 	addr = DCACHE_ALIGN(addr - offset) + offset;
 
-	for (vma = find_vma(current->mm, addr); ; vma = vma->vm_next) {
+	for (vma = find_vma_prev(current->mm, addr, &prev); ; vma = vma->vm_next) {
 		/* At this point:  (!vma || addr < vma->vm_end). */
 		if (TASK_SIZE - len < addr)
 			return -ENOMEM;
-		if (!vma || addr + len <= vma->vm_start)
+		if ((!vma || addr + len <= vma->vm_start) &&
+		    (!prev || addr >= vm_end_gap(prev)))
 			return addr;
-		addr = DCACHE_ALIGN(vma->vm_end - offset) + offset;
-		if (addr < vma->vm_end) /* handle wraparound */
+		addr = DCACHE_ALIGN(vm_end_gap(vma) - offset) + offset;
+		if (addr < vm_end_gap(vma)) /* handle wraparound */
 			return -ENOMEM;
 	}
 }
--- a/arch/powerpc/mm/slice.c
+++ b/arch/powerpc/mm/slice.c
@@ -98,7 +98,7 @@ static int slice_area_is_free(struct mm_
 	if ((mm->task_size - len) < addr)
 		return 0;
 	vma = find_vma(mm, addr);
-	return (!vma || (addr + len) <= vma->vm_start);
+	return (!vma || (addr + len) <= vm_start_gap(vma));
 }
 
 static int slice_low_has_vma(struct mm_struct *mm, unsigned long slice)
@@ -256,7 +256,7 @@ full_search:
 				addr = _ALIGN_UP(addr + 1,  1ul << SLICE_HIGH_SHIFT);
 			continue;
 		}
-		if (!vma || addr + len <= vma->vm_start) {
+		if (!vma || addr + len <= vm_start_gap(vma)) {
 			/*
 			 * Remember the place where we stopped the search:
 			 */
@@ -264,8 +264,8 @@ full_search:
 				mm->free_area_cache = addr + len;
 			return addr;
 		}
-		if (use_cache && (addr + mm->cached_hole_size) < vma->vm_start)
-		        mm->cached_hole_size = vma->vm_start - addr;
+		if (use_cache && (addr + mm->cached_hole_size) < vm_start_gap(vma))
+		        mm->cached_hole_size = vm_start_gap(vma) - addr;
 		addr = vma->vm_end;
 	}
 
@@ -336,7 +336,7 @@ static unsigned long slice_find_area_top
 		 * return with success:
 		 */
 		vma = find_vma(mm, addr);
-		if (!vma || (addr + len) <= vma->vm_start) {
+		if (!vma || (addr + len) <= vm_start_gap(vma)) {
 			/* remember the address as a hint for next time */
 			if (use_cache)
 				mm->free_area_cache = addr;
@@ -344,11 +344,11 @@ static unsigned long slice_find_area_top
 		}
 
 		/* remember the largest hole we saw so far */
-		if (use_cache && (addr + mm->cached_hole_size) < vma->vm_start)
-		        mm->cached_hole_size = vma->vm_start - addr;
+		if (use_cache && (addr + mm->cached_hole_size) < vm_start_gap(vma))
+		        mm->cached_hole_size = vm_start_gap(vma) - addr;
 
 		/* try just below the current vma->vm_start */
-		addr = vma->vm_start;
+		addr = vm_start_gap(vma);
 	}
 
 	/*
--- a/arch/sh/mm/mmap.c
+++ b/arch/sh/mm/mmap.c
@@ -75,7 +75,7 @@ unsigned long arch_get_unmapped_area(str
 
 		vma = find_vma(mm, addr);
 		if (TASK_SIZE - len >= addr &&
-		    (!vma || addr + len <= vma->vm_start))
+		    (!vma || addr + len <= vm_start_gap(vma)))
 			return addr;
 	}
 
@@ -106,15 +106,15 @@ full_search:
 			}
 			return -ENOMEM;
 		}
-		if (likely(!vma || addr + len <= vma->vm_start)) {
+		if (likely(!vma || addr + len <= vm_start_gap(vma))) {
 			/*
 			 * Remember the place where we stopped the search:
 			 */
 			mm->free_area_cache = addr + len;
 			return addr;
 		}
-		if (addr + mm->cached_hole_size < vma->vm_start)
-		        mm->cached_hole_size = vma->vm_start - addr;
+		if (addr + mm->cached_hole_size < vm_start_gap(vma))
+		        mm->cached_hole_size = vm_start_gap(vma) - addr;
 
 		addr = vma->vm_end;
 		if (do_colour_align)
@@ -158,7 +158,7 @@ arch_get_unmapped_area_topdown(struct fi
 
 		vma = find_vma(mm, addr);
 		if (TASK_SIZE - len >= addr &&
-		    (!vma || addr + len <= vma->vm_start))
+		    (!vma || addr + len <= vm_start_gap(vma)))
 			return addr;
 	}
 
@@ -179,7 +179,7 @@ arch_get_unmapped_area_topdown(struct fi
 	/* make sure it can fit in the remaining address space */
 	if (likely(addr > len)) {
 		vma = find_vma(mm, addr-len);
-		if (!vma || addr <= vma->vm_start) {
+		if (!vma || addr <= vm_start_gap(vma)) {
 			/* remember the address as a hint for next time */
 			return (mm->free_area_cache = addr-len);
 		}
@@ -199,20 +199,20 @@ arch_get_unmapped_area_topdown(struct fi
 		 * return with success:
 		 */
 		vma = find_vma(mm, addr);
-		if (likely(!vma || addr+len <= vma->vm_start)) {
+		if (likely(!vma || addr + len <= vm_start_gap(vma))) {
 			/* remember the address as a hint for next time */
 			return (mm->free_area_cache = addr);
 		}
 
 		/* remember the largest hole we saw so far */
-		if (addr + mm->cached_hole_size < vma->vm_start)
-		        mm->cached_hole_size = vma->vm_start - addr;
+		if (addr + mm->cached_hole_size < vm_start_gap(vma))
+		        mm->cached_hole_size = vm_start_gap(vma) - addr;
 
 		/* try just below the current vma->vm_start */
-		addr = vma->vm_start-len;
+		addr = vm_start_gap(vma) - len;
 		if (do_colour_align)
 			addr = COLOUR_ALIGN_DOWN(addr, pgoff);
-	} while (likely(len < vma->vm_start));
+	} while (likely(len < vm_start_gap(vma)));
 
 bottomup:
 	/*
--- a/arch/sparc/kernel/sys_sparc_64.c
+++ b/arch/sparc/kernel/sys_sparc_64.c
@@ -147,7 +147,7 @@ unsigned long arch_get_unmapped_area(str
 
 		vma = find_vma(mm, addr);
 		if (task_size - len >= addr &&
-		    (!vma || addr + len <= vma->vm_start))
+		    (!vma || addr + len <= vm_start_gap(vma)))
 			return addr;
 	}
 
@@ -181,15 +181,15 @@ full_search:
 			}
 			return -ENOMEM;
 		}
-		if (likely(!vma || addr + len <= vma->vm_start)) {
+		if (likely(!vma || addr + len <= vm_start_gap(vma))) {
 			/*
 			 * Remember the place where we stopped the search:
 			 */
 			mm->free_area_cache = addr + len;
 			return addr;
 		}
-		if (addr + mm->cached_hole_size < vma->vm_start)
-		        mm->cached_hole_size = vma->vm_start - addr;
+		if (addr + mm->cached_hole_size < vm_start_gap(vma))
+		        mm->cached_hole_size = vm_start_gap(vma) - addr;
 
 		addr = vma->vm_end;
 		if (do_color_align)
@@ -237,7 +237,7 @@ arch_get_unmapped_area_topdown(struct fi
 
 		vma = find_vma(mm, addr);
 		if (task_size - len >= addr &&
-		    (!vma || addr + len <= vma->vm_start))
+		    (!vma || addr + len <= vm_start_gap(vma)))
 			return addr;
 	}
 
@@ -258,7 +258,7 @@ arch_get_unmapped_area_topdown(struct fi
 	/* make sure it can fit in the remaining address space */
 	if (likely(addr > len)) {
 		vma = find_vma(mm, addr-len);
-		if (!vma || addr <= vma->vm_start) {
+		if (!vma || addr <= vm_start_gap(vma)) {
 			/* remember the address as a hint for next time */
 			return (mm->free_area_cache = addr-len);
 		}
@@ -278,20 +278,20 @@ arch_get_unmapped_area_topdown(struct fi
 		 * return with success:
 		 */
 		vma = find_vma(mm, addr);
-		if (likely(!vma || addr+len <= vma->vm_start)) {
+		if (likely(!vma || addr + len <= vm_start_gap(vma))) {
 			/* remember the address as a hint for next time */
 			return (mm->free_area_cache = addr);
 		}
 
  		/* remember the largest hole we saw so far */
- 		if (addr + mm->cached_hole_size < vma->vm_start)
- 		        mm->cached_hole_size = vma->vm_start - addr;
+ 		if (addr + mm->cached_hole_size < vm_start_gap(vma))
+ 		        mm->cached_hole_size = vm_start_gap(vma) - addr;
 
 		/* try just below the current vma->vm_start */
-		addr = vma->vm_start-len;
+		addr = vm_start_gap(vma) - len;
 		if (do_color_align)
 			addr = COLOUR_ALIGN_DOWN(addr, pgoff);
-	} while (likely(len < vma->vm_start));
+	} while (likely(len < vm_start_gap(vma)));
 
 bottomup:
 	/*
--- a/arch/sparc/mm/hugetlbpage.c
+++ b/arch/sparc/mm/hugetlbpage.c
@@ -67,15 +67,15 @@ full_search:
 			}
 			return -ENOMEM;
 		}
-		if (likely(!vma || addr + len <= vma->vm_start)) {
+		if (likely(!vma || addr + len <= vm_start_gap(vma))) {
 			/*
 			 * Remember the place where we stopped the search:
 			 */
 			mm->free_area_cache = addr + len;
 			return addr;
 		}
-		if (addr + mm->cached_hole_size < vma->vm_start)
-		        mm->cached_hole_size = vma->vm_start - addr;
+		if (addr + mm->cached_hole_size < vm_start_gap(vma))
+		        mm->cached_hole_size = vm_start_gap(vma) - addr;
 
 		addr = ALIGN(vma->vm_end, HPAGE_SIZE);
 	}
@@ -182,7 +182,7 @@ hugetlb_get_unmapped_area(struct file *f
 		addr = ALIGN(addr, HPAGE_SIZE);
 		vma = find_vma(mm, addr);
 		if (task_size - len >= addr &&
-		    (!vma || addr + len <= vma->vm_start))
+		    (!vma || addr + len <= vm_start_gap(vma)))
 			return addr;
 	}
 	if (mm->get_unmapped_area == arch_get_unmapped_area)
--- a/arch/tile/mm/hugetlbpage.c
+++ b/arch/tile/mm/hugetlbpage.c
@@ -185,12 +185,12 @@ full_search:
 			}
 			return -ENOMEM;
 		}
-		if (!vma || addr + len <= vma->vm_start) {
+		if (!vma || addr + len <= vm_start_gap(vma)) {
 			mm->free_area_cache = addr + len;
 			return addr;
 		}
-		if (addr + mm->cached_hole_size < vma->vm_start)
-			mm->cached_hole_size = vma->vm_start - addr;
+		if (addr + mm->cached_hole_size < vm_start_gap(vma))
+			mm->cached_hole_size = vm_start_gap(vma) - addr;
 		addr = ALIGN(vma->vm_end, huge_page_size(h));
 	}
 }
@@ -236,7 +236,7 @@ try_again:
 		 * new region fits between prev_vma->vm_end and
 		 * vma->vm_start, use it:
 		 */
-		if (addr + len <= vma->vm_start &&
+		if (addr + len <= vm_start_gap(vma) &&
 			    (!prev_vma || (addr >= prev_vma->vm_end))) {
 			/* remember the address as a hint for next time */
 			mm->cached_hole_size = largest_hole;
@@ -251,13 +251,13 @@ try_again:
 		}
 
 		/* remember the largest hole we saw so far */
-		if (addr + largest_hole < vma->vm_start)
-			largest_hole = vma->vm_start - addr;
+		if (addr + largest_hole < vm_start_gap(vma))
+			largest_hole = vm_start_gap(vma) - addr;
 
 		/* try just below the current vma->vm_start */
-		addr = (vma->vm_start - len) & huge_page_mask(h);
+		addr = (vm_start_gap(vma) - len) & huge_page_mask(h);
 
-	} while (len <= vma->vm_start);
+	} while (len <= vm_start_gap(vma));
 
 fail:
 	/*
@@ -312,7 +312,7 @@ unsigned long hugetlb_get_unmapped_area(
 		addr = ALIGN(addr, huge_page_size(h));
 		vma = find_vma(mm, addr);
 		if (TASK_SIZE - len >= addr &&
-		    (!vma || addr + len <= vma->vm_start))
+		    (!vma || addr + len <= vm_start_gap(vma)))
 			return addr;
 	}
 	if (current->mm->get_unmapped_area == arch_get_unmapped_area)
--- a/arch/x86/kernel/sys_x86_64.c
+++ b/arch/x86/kernel/sys_x86_64.c
@@ -141,7 +141,7 @@ arch_get_unmapped_area(struct file *filp
 		addr = PAGE_ALIGN(addr);
 		vma = find_vma(mm, addr);
 		if (end - len >= addr &&
-		    (!vma || addr + len <= vma->vm_start))
+		    (!vma || addr + len <= vm_start_gap(vma)))
 			return addr;
 	}
 	if (((flags & MAP_32BIT) || test_thread_flag(TIF_IA32))
@@ -172,15 +172,15 @@ full_search:
 			}
 			return -ENOMEM;
 		}
-		if (!vma || addr + len <= vma->vm_start) {
+		if (!vma || addr + len <= vm_start_gap(vma)) {
 			/*
 			 * Remember the place where we stopped the search:
 			 */
 			mm->free_area_cache = addr + len;
 			return addr;
 		}
-		if (addr + mm->cached_hole_size < vma->vm_start)
-			mm->cached_hole_size = vma->vm_start - addr;
+		if (addr + mm->cached_hole_size < vm_start_gap(vma))
+			mm->cached_hole_size = vm_start_gap(vma) - addr;
 
 		addr = vma->vm_end;
 		addr = align_addr(addr, filp, 0);
@@ -213,7 +213,7 @@ arch_get_unmapped_area_topdown(struct fi
 		addr = PAGE_ALIGN(addr);
 		vma = find_vma(mm, addr);
 		if (TASK_SIZE - len >= addr &&
-				(!vma || addr + len <= vma->vm_start))
+				(!vma || addr + len <= vm_start_gap(vma)))
 			return addr;
 	}
 
@@ -232,7 +232,7 @@ arch_get_unmapped_area_topdown(struct fi
 						    ALIGN_TOPDOWN);
 
 		vma = find_vma(mm, tmp_addr);
-		if (!vma || tmp_addr + len <= vma->vm_start)
+		if (!vma || tmp_addr + len <= vm_start_gap(vma))
 			/* remember the address as a hint for next time */
 			return mm->free_area_cache = tmp_addr;
 	}
@@ -251,17 +251,17 @@ arch_get_unmapped_area_topdown(struct fi
 		 * return with success:
 		 */
 		vma = find_vma(mm, addr);
-		if (!vma || addr+len <= vma->vm_start)
+		if (!vma || addr + len <= vm_start_gap(vma))
 			/* remember the address as a hint for next time */
 			return mm->free_area_cache = addr;
 
 		/* remember the largest hole we saw so far */
-		if (addr + mm->cached_hole_size < vma->vm_start)
-			mm->cached_hole_size = vma->vm_start - addr;
+		if (addr + mm->cached_hole_size < vm_start_gap(vma))
+			mm->cached_hole_size = vm_start_gap(vma) - addr;
 
 		/* try just below the current vma->vm_start */
-		addr = vma->vm_start-len;
-	} while (len < vma->vm_start);
+		addr = vm_start_gap(vma) - len;
+	} while (len < vm_start_gap(vma));
 
 bottomup:
 	/*
--- a/arch/x86/mm/hugetlbpage.c
+++ b/arch/x86/mm/hugetlbpage.c
@@ -303,12 +303,12 @@ full_search:
 			}
 			return -ENOMEM;
 		}
-		if (!vma || addr + len <= vma->vm_start) {
+		if (!vma || addr + len <= vm_start_gap(vma)) {
 			mm->free_area_cache = addr + len;
 			return addr;
 		}
-		if (addr + mm->cached_hole_size < vma->vm_start)
-		        mm->cached_hole_size = vma->vm_start - addr;
+		if (addr + mm->cached_hole_size < vm_start_gap(vma))
+		        mm->cached_hole_size = vm_start_gap(vma) - addr;
 		addr = ALIGN(vma->vm_end, huge_page_size(h));
 	}
 }
@@ -351,7 +351,7 @@ try_again:
 		 * new region fits between prev_vma->vm_end and
 		 * vma->vm_start, use it:
 		 */
-		if (addr + len <= vma->vm_start &&
+		if (addr + len <= vm_start_gap(vma) &&
 		            (!prev_vma || (addr >= prev_vma->vm_end))) {
 			/* remember the address as a hint for next time */
 		        mm->cached_hole_size = largest_hole;
@@ -365,12 +365,12 @@ try_again:
 		}
 
 		/* remember the largest hole we saw so far */
-		if (addr + largest_hole < vma->vm_start)
-		        largest_hole = vma->vm_start - addr;
+		if (addr + largest_hole < vm_start_gap(vma))
+		        largest_hole = vm_start_gap(vma) - addr;
 
 		/* try just below the current vma->vm_start */
-		addr = (vma->vm_start - len) & huge_page_mask(h);
-	} while (len <= vma->vm_start);
+		addr = (vm_start_gap(vma) - len) & huge_page_mask(h);
+	} while (len <= vm_start_gap(vma));
 
 fail:
 	/*
@@ -426,7 +426,7 @@ hugetlb_get_unmapped_area(struct file *f
 		addr = ALIGN(addr, huge_page_size(h));
 		vma = find_vma(mm, addr);
 		if (TASK_SIZE - len >= addr &&
-		    (!vma || addr + len <= vma->vm_start))
+		    (!vma || addr + len <= vm_start_gap(vma)))
 			return addr;
 	}
 	if (mm->get_unmapped_area == arch_get_unmapped_area)
--- a/fs/hugetlbfs/inode.c
+++ b/fs/hugetlbfs/inode.c
@@ -150,7 +150,7 @@ hugetlb_get_unmapped_area(struct file *f
 		addr = ALIGN(addr, huge_page_size(h));
 		vma = find_vma(mm, addr);
 		if (TASK_SIZE - len >= addr &&
-		    (!vma || addr + len <= vma->vm_start))
+		    (!vma || addr + len <= vm_start_gap(vma)))
 			return addr;
 	}
 
@@ -176,7 +176,7 @@ full_search:
 			return -ENOMEM;
 		}
 
-		if (!vma || addr + len <= vma->vm_start)
+		if (!vma || addr + len <= vm_start_gap(vma))
 			return addr;
 		addr = ALIGN(vma->vm_end, huge_page_size(h));
 	}
--- a/fs/proc/task_mmu.c
+++ b/fs/proc/task_mmu.c
@@ -230,11 +230,7 @@ static void show_map_vma(struct seq_file
 
 	/* We don't show the stack guard page in /proc/maps */
 	start = vma->vm_start;
-	if (stack_guard_page_start(vma, start))
-		start += PAGE_SIZE;
 	end = vma->vm_end;
-	if (stack_guard_page_end(vma, end))
-		end -= PAGE_SIZE;
 
 	seq_printf(m, "%08lx-%08lx %c%c%c%c %08llx %02x:%02x %lu %n",
 			start,
--- a/include/linux/mm.h
+++ b/include/linux/mm.h
@@ -1015,34 +1015,6 @@ int set_page_dirty(struct page *page);
 int set_page_dirty_lock(struct page *page);
 int clear_page_dirty_for_io(struct page *page);
 
-/* Is the vma a continuation of the stack vma above it? */
-static inline int vma_growsdown(struct vm_area_struct *vma, unsigned long addr)
-{
-	return vma && (vma->vm_end == addr) && (vma->vm_flags & VM_GROWSDOWN);
-}
-
-static inline int stack_guard_page_start(struct vm_area_struct *vma,
-					     unsigned long addr)
-{
-	return (vma->vm_flags & VM_GROWSDOWN) &&
-		(vma->vm_start == addr) &&
-		!vma_growsdown(vma->vm_prev, addr);
-}
-
-/* Is the vma a continuation of the stack vma below it? */
-static inline int vma_growsup(struct vm_area_struct *vma, unsigned long addr)
-{
-	return vma && (vma->vm_start == addr) && (vma->vm_flags & VM_GROWSUP);
-}
-
-static inline int stack_guard_page_end(struct vm_area_struct *vma,
-					   unsigned long addr)
-{
-	return (vma->vm_flags & VM_GROWSUP) &&
-		(vma->vm_end == addr) &&
-		!vma_growsup(vma->vm_next, addr);
-}
-
 extern unsigned long move_page_tables(struct vm_area_struct *vma,
 		unsigned long old_addr, struct vm_area_struct *new_vma,
 		unsigned long new_addr, unsigned long len);
@@ -1462,6 +1434,7 @@ unsigned long ra_submit(struct file_ra_s
 			struct address_space *mapping,
 			struct file *filp);
 
+extern unsigned long stack_guard_gap;
 /* Generic expand stack which grows the stack according to GROWS{UP,DOWN} */
 extern int expand_stack(struct vm_area_struct *vma, unsigned long address);
 
@@ -1490,6 +1463,30 @@ static inline struct vm_area_struct * fi
 	return vma;
 }
 
+static inline unsigned long vm_start_gap(struct vm_area_struct *vma)
+{
+	unsigned long vm_start = vma->vm_start;
+
+	if (vma->vm_flags & VM_GROWSDOWN) {
+		vm_start -= stack_guard_gap;
+		if (vm_start > vma->vm_start)
+			vm_start = 0;
+	}
+	return vm_start;
+}
+
+static inline unsigned long vm_end_gap(struct vm_area_struct *vma)
+{
+	unsigned long vm_end = vma->vm_end;
+
+	if (vma->vm_flags & VM_GROWSUP) {
+		vm_end += stack_guard_gap;
+		if (vm_end < vma->vm_end)
+			vm_end = -PAGE_SIZE;
+	}
+	return vm_end;
+}
+
 static inline unsigned long vma_pages(struct vm_area_struct *vma)
 {
 	return (vma->vm_end - vma->vm_start) >> PAGE_SHIFT;
--- a/mm/memory.c
+++ b/mm/memory.c
@@ -1605,12 +1605,6 @@ no_page_table:
 	return page;
 }
 
-static inline int stack_guard_page(struct vm_area_struct *vma, unsigned long addr)
-{
-	return stack_guard_page_start(vma, addr) ||
-	       stack_guard_page_end(vma, addr+PAGE_SIZE);
-}
-
 /**
  * __get_user_pages() - pin user pages in memory
  * @tsk:	task_struct of target task
@@ -1761,11 +1755,6 @@ int __get_user_pages(struct task_struct
 				int ret;
 				unsigned int fault_flags = 0;
 
-				/* For mlock, just skip the stack guard page. */
-				if (foll_flags & FOLL_MLOCK) {
-					if (stack_guard_page(vma, start))
-						goto next_page;
-				}
 				if (foll_flags & FOLL_WRITE)
 					fault_flags |= FAULT_FLAG_WRITE;
 				if (nonblocking)
@@ -3122,40 +3111,6 @@ out_release:
 }
 
 /*
- * This is like a special single-page "expand_{down|up}wards()",
- * except we must first make sure that 'address{-|+}PAGE_SIZE'
- * doesn't hit another vma.
- */
-static inline int check_stack_guard_page(struct vm_area_struct *vma, unsigned long address)
-{
-	address &= PAGE_MASK;
-	if ((vma->vm_flags & VM_GROWSDOWN) && address == vma->vm_start) {
-		struct vm_area_struct *prev = vma->vm_prev;
-
-		/*
-		 * Is there a mapping abutting this one below?
-		 *
-		 * That's only ok if it's the same stack mapping
-		 * that has gotten split..
-		 */
-		if (prev && prev->vm_end == address)
-			return prev->vm_flags & VM_GROWSDOWN ? 0 : -ENOMEM;
-
-		return expand_downwards(vma, address - PAGE_SIZE);
-	}
-	if ((vma->vm_flags & VM_GROWSUP) && address + PAGE_SIZE == vma->vm_end) {
-		struct vm_area_struct *next = vma->vm_next;
-
-		/* As VM_GROWSDOWN but s/below/above/ */
-		if (next && next->vm_start == address + PAGE_SIZE)
-			return next->vm_flags & VM_GROWSUP ? 0 : -ENOMEM;
-
-		return expand_upwards(vma, address + PAGE_SIZE);
-	}
-	return 0;
-}
-
-/*
  * We enter with non-exclusive mmap_sem (to exclude vma changes,
  * but allow concurrent faults), and pte mapped but not yet locked.
  * We return with mmap_sem still held, but pte unmapped and unlocked.
@@ -3174,10 +3129,6 @@ static int do_anonymous_page(struct mm_s
 	if (vma->vm_flags & VM_SHARED)
 		return VM_FAULT_SIGBUS;
 
-	/* Check if we need to add a guard page to the stack */
-	if (check_stack_guard_page(vma, address) < 0)
-		return VM_FAULT_SIGSEGV;
-
 	/* Use the zero-page for reads */
 	if (!(flags & FAULT_FLAG_WRITE)) {
 		entry = pte_mkspecial(pfn_pte(my_zero_pfn(address),
--- a/mm/mmap.c
+++ b/mm/mmap.c
@@ -245,6 +245,7 @@ SYSCALL_DEFINE1(brk, unsigned long, brk)
 	unsigned long rlim, retval;
 	unsigned long newbrk, oldbrk;
 	struct mm_struct *mm = current->mm;
+	struct vm_area_struct *next;
 	unsigned long min_brk;
 
 	down_write(&mm->mmap_sem);
@@ -289,7 +290,8 @@ SYSCALL_DEFINE1(brk, unsigned long, brk)
 	}
 
 	/* Check against existing mmap mappings. */
-	if (find_vma_intersection(mm, oldbrk, newbrk+PAGE_SIZE))
+	next = find_vma(mm, oldbrk);
+	if (next && newbrk + PAGE_SIZE > vm_start_gap(next))
 		goto out;
 
 	/* Ok, looks good - let it rip. */
@@ -1368,7 +1370,7 @@ arch_get_unmapped_area(struct file *filp
 		unsigned long len, unsigned long pgoff, unsigned long flags)
 {
 	struct mm_struct *mm = current->mm;
-	struct vm_area_struct *vma;
+	struct vm_area_struct *vma, *prev;
 	unsigned long start_addr;
 
 	if (len > TASK_SIZE - mmap_min_addr)
@@ -1379,9 +1381,10 @@ arch_get_unmapped_area(struct file *filp
 
 	if (addr) {
 		addr = PAGE_ALIGN(addr);
-		vma = find_vma(mm, addr);
+		vma = find_vma_prev(mm, addr, &prev);
 		if (TASK_SIZE - len >= addr && addr >= mmap_min_addr &&
-		    (!vma || addr + len <= vma->vm_start))
+		    (!vma || addr + len <= vm_start_gap(vma)) &&
+		    (!prev || addr >= vm_end_gap(prev)))
 			return addr;
 	}
 	if (len > mm->cached_hole_size) {
@@ -1407,16 +1410,16 @@ full_search:
 			}
 			return -ENOMEM;
 		}
-		if (!vma || addr + len <= vma->vm_start) {
+		if (!vma || addr + len <= vm_start_gap(vma)) {
 			/*
 			 * Remember the place where we stopped the search:
 			 */
 			mm->free_area_cache = addr + len;
 			return addr;
 		}
-		if (addr + mm->cached_hole_size < vma->vm_start)
-		        mm->cached_hole_size = vma->vm_start - addr;
-		addr = vma->vm_end;
+		if (addr + mm->cached_hole_size < vm_start_gap(vma))
+		        mm->cached_hole_size = vm_start_gap(vma) - addr;
+		addr = vm_end_gap(vma);
 	}
 }
 #endif	
@@ -1442,7 +1445,7 @@ arch_get_unmapped_area_topdown(struct fi
 			  const unsigned long len, const unsigned long pgoff,
 			  const unsigned long flags)
 {
-	struct vm_area_struct *vma;
+	struct vm_area_struct *vma, *prev;
 	struct mm_struct *mm = current->mm;
 	unsigned long addr = addr0;
 	unsigned long low_limit = max(PAGE_SIZE, mmap_min_addr);
@@ -1457,9 +1460,10 @@ arch_get_unmapped_area_topdown(struct fi
 	/* requesting a specific address */
 	if (addr) {
 		addr = PAGE_ALIGN(addr);
-		vma = find_vma(mm, addr);
+		vma = find_vma_prev(mm, addr, &prev);
 		if (TASK_SIZE - len >= addr && addr >= mmap_min_addr &&
-				(!vma || addr + len <= vma->vm_start))
+				(!vma || addr + len <= vm_start_gap(vma)) &&
+				(!prev || addr >= vm_end_gap(prev)))
 			return addr;
 	}
 
@@ -1475,7 +1479,7 @@ arch_get_unmapped_area_topdown(struct fi
 	/* make sure it can fit in the remaining address space */
 	if (addr >= low_limit + len) {
 		vma = find_vma(mm, addr-len);
-		if (!vma || addr <= vma->vm_start)
+		if (!vma || addr <= vm_start_gap(vma))
 			/* remember the address as a hint for next time */
 			return (mm->free_area_cache = addr-len);
 	}
@@ -1492,17 +1496,17 @@ arch_get_unmapped_area_topdown(struct fi
 		 * return with success:
 		 */
 		vma = find_vma(mm, addr);
-		if (!vma || addr+len <= vma->vm_start)
+		if (!vma || addr + len <= vm_start_gap(vma))
 			/* remember the address as a hint for next time */
 			return (mm->free_area_cache = addr);
 
  		/* remember the largest hole we saw so far */
- 		if (addr + mm->cached_hole_size < vma->vm_start)
- 		        mm->cached_hole_size = vma->vm_start - addr;
+ 		if (addr + mm->cached_hole_size < vm_start_gap(vma))
+ 		        mm->cached_hole_size = vm_start_gap(vma) - addr;
 
 		/* try just below the current vma->vm_start */
-		addr = vma->vm_start-len;
-	} while (vma->vm_start >= low_limit + len);
+		addr = vm_start_gap(vma) - len;
+	} while (vm_start_gap(vma) >= low_limit + len);
 
 bottomup:
 	/*
@@ -1647,21 +1651,19 @@ out:
  * update accounting. This is shared with both the
  * grow-up and grow-down cases.
  */
-static int acct_stack_growth(struct vm_area_struct *vma, unsigned long size, unsigned long grow)
+static int acct_stack_growth(struct vm_area_struct *vma,
+			     unsigned long size, unsigned long grow)
 {
 	struct mm_struct *mm = vma->vm_mm;
 	struct rlimit *rlim = current->signal->rlim;
-	unsigned long new_start, actual_size;
+	unsigned long new_start;
 
 	/* address space limit tests */
 	if (!may_expand_vm(mm, grow))
 		return -ENOMEM;
 
 	/* Stack limit test */
-	actual_size = size;
-	if (size && (vma->vm_flags & (VM_GROWSUP | VM_GROWSDOWN)))
-		actual_size -= PAGE_SIZE;
-	if (actual_size > ACCESS_ONCE(rlim[RLIMIT_STACK].rlim_cur))
+	if (size > ACCESS_ONCE(rlim[RLIMIT_STACK].rlim_cur))
 		return -ENOMEM;
 
 	/* mlock limit tests */
@@ -1703,32 +1705,40 @@ static int acct_stack_growth(struct vm_a
  */
 int expand_upwards(struct vm_area_struct *vma, unsigned long address)
 {
-	int error;
+	struct vm_area_struct *next;
+	unsigned long gap_addr;
+	int error = 0;
 
 	if (!(vma->vm_flags & VM_GROWSUP))
 		return -EFAULT;
 
-	/*
-	 * We must make sure the anon_vma is allocated
-	 * so that the anon_vma locking is not a noop.
-	 */
+	/* Guard against wrapping around to address 0. */
+	address &= PAGE_MASK;
+	address += PAGE_SIZE;
+	if (!address)
+		return -ENOMEM;
+
+	/* Enforce stack_guard_gap */
+	gap_addr = address + stack_guard_gap;
+	if (gap_addr < address)
+		return -ENOMEM;
+	next = vma->vm_next;
+	if (next && next->vm_start < gap_addr) {
+		if (!(next->vm_flags & VM_GROWSUP))
+			return -ENOMEM;
+		/* Check that both stack segments have the same anon_vma? */
+	}
+
+	/* We must make sure the anon_vma is allocated. */
 	if (unlikely(anon_vma_prepare(vma)))
 		return -ENOMEM;
-	vma_lock_anon_vma(vma);
 
 	/*
 	 * vma->vm_start/vm_end cannot change under us because the caller
 	 * is required to hold the mmap_sem in read mode.  We need the
 	 * anon_vma lock to serialize against concurrent expand_stacks.
-	 * Also guard against wrapping around to address 0.
 	 */
-	if (address < PAGE_ALIGN(address+4))
-		address = PAGE_ALIGN(address+4);
-	else {
-		vma_unlock_anon_vma(vma);
-		return -ENOMEM;
-	}
-	error = 0;
+	vma_lock_anon_vma(vma);
 
 	/* Somebody else might have raced and expanded it already */
 	if (address > vma->vm_end) {
@@ -1758,27 +1768,36 @@ int expand_upwards(struct vm_area_struct
 int expand_downwards(struct vm_area_struct *vma,
 				   unsigned long address)
 {
+	struct vm_area_struct *prev;
+	unsigned long gap_addr;
 	int error;
 
-	/*
-	 * We must make sure the anon_vma is allocated
-	 * so that the anon_vma locking is not a noop.
-	 */
-	if (unlikely(anon_vma_prepare(vma)))
-		return -ENOMEM;
-
 	address &= PAGE_MASK;
 	error = security_file_mmap(NULL, 0, 0, 0, address, 1);
 	if (error)
 		return error;
 
-	vma_lock_anon_vma(vma);
+	/* Enforce stack_guard_gap */
+	gap_addr = address - stack_guard_gap;
+	if (gap_addr > address)
+		return -ENOMEM;
+	prev = vma->vm_prev;
+	if (prev && prev->vm_end > gap_addr) {
+		if (!(prev->vm_flags & VM_GROWSDOWN))
+			return -ENOMEM;
+		/* Check that both stack segments have the same anon_vma? */
+	}
+
+	/* We must make sure the anon_vma is allocated. */
+	if (unlikely(anon_vma_prepare(vma)))
+		return -ENOMEM;
 
 	/*
 	 * vma->vm_start/vm_end cannot change under us because the caller
 	 * is required to hold the mmap_sem in read mode.  We need the
 	 * anon_vma lock to serialize against concurrent expand_stacks.
 	 */
+	vma_lock_anon_vma(vma);
 
 	/* Somebody else might have raced and expanded it already */
 	if (address < vma->vm_start) {
@@ -1802,28 +1821,25 @@ int expand_downwards(struct vm_area_stru
 	return error;
 }
 
-/*
- * Note how expand_stack() refuses to expand the stack all the way to
- * abut the next virtual mapping, *unless* that mapping itself is also
- * a stack mapping. We want to leave room for a guard page, after all
- * (the guard page itself is not added here, that is done by the
- * actual page faulting logic)
- *
- * This matches the behavior of the guard page logic (see mm/memory.c:
- * check_stack_guard_page()), which only allows the guard page to be
- * removed under these circumstances.
- */
+/* enforced gap between the expanding stack and other mappings. */
+unsigned long stack_guard_gap = 256UL<<PAGE_SHIFT;
+
+static int __init cmdline_parse_stack_guard_gap(char *p)
+{
+	unsigned long val;
+	char *endptr;
+
+	val = simple_strtoul(p, &endptr, 10);
+	if (!*endptr)
+		stack_guard_gap = val << PAGE_SHIFT;
+
+	return 0;
+}
+__setup("stack_guard_gap=", cmdline_parse_stack_guard_gap);
+
 #ifdef CONFIG_STACK_GROWSUP
 int expand_stack(struct vm_area_struct *vma, unsigned long address)
 {
-	struct vm_area_struct *next;
-
-	address &= PAGE_MASK;
-	next = vma->vm_next;
-	if (next && next->vm_start == address + PAGE_SIZE) {
-		if (!(next->vm_flags & VM_GROWSUP))
-			return -ENOMEM;
-	}
 	return expand_upwards(vma, address);
 }
 
@@ -1846,14 +1862,6 @@ find_extend_vma(struct mm_struct *mm, un
 #else
 int expand_stack(struct vm_area_struct *vma, unsigned long address)
 {
-	struct vm_area_struct *prev;
-
-	address &= PAGE_MASK;
-	prev = vma->vm_prev;
-	if (prev && prev->vm_end == address) {
-		if (!(prev->vm_flags & VM_GROWSDOWN))
-			return -ENOMEM;
-	}
 	return expand_downwards(vma, address);
 }
 

-- 
Ben Hutchings
Sturgeon's Law: Ninety percent of everything is crap.


[-- Attachment #2: Digital signature --]
[-- Type: application/pgp-signature, Size: 811 bytes --]

Re: [PATCH] mm: larger stack guard gap, between vmas

[Willy Tarreau]

On Thu, Jun 22, 2017 at 01:30:45PM +0100, Ben Hutchings wrote:
> Here's my attempt at a backport to 3.2.  This is only tested on
> x86_64 and I think I should introduce local variables for
> vma_start_gap() in a few places.  I had to cherry-pick commit
> 09884964335e "mm: do not grow the stack vma just because of an overrun
> on preceding vma" before this one (which was a clean cherry-pick).

Ben, I can't apply it on top of 3.2.89 + the patch above, do you have
any other patch in your local branch ? For example the patch tries to
modify a hunk starting at line 183 of arch/arm/mm/mmap.c while the one
I'm having here ends at line 159.

Willy

Re: [PATCH] mm: larger stack guard gap, between vmas

[Ben Hutchings]

[-- Attachment #1: Type: text/plain, Size: 1100 bytes --]

On Thu, 2017-06-22 at 14:46 +0200, Willy Tarreau wrote:
> On Thu, Jun 22, 2017 at 01:30:45PM +0100, Ben Hutchings wrote:
> > Here's my attempt at a backport to 3.2.  This is only tested on
> > x86_64 and I think I should introduce local variables for
> > vma_start_gap() in a few places.  I had to cherry-pick commit
> > 09884964335e "mm: do not grow the stack vma just because of an overrun
> > on preceding vma" before this one (which was a clean cherry-pick).
> 
> Ben, I can't apply it on top of 3.2.89 + the patch above, do you have
> any other patch in your local branch ? For example the patch tries to
> modify a hunk starting at line 183 of arch/arm/mm/mmap.c while the one
> I'm having here ends at line 159.

Sorry, yes, I did this on top of the Debian 3.2 branch and that *does*
have a patch to arch/arm/mm/mmap.c that I had forgotten about (commit
7dbaa466780a "ARM: 7169/1: topdown mmap support").  I think you can
just drop the changes in ARM's arch_get_unmapped_area_topdown().

Ben.

-- 
Ben Hutchings
Sturgeon's Law: Ninety percent of everything is crap.

[-- Attachment #2: This is a digitally signed message part --]
[-- Type: application/pgp-signature, Size: 833 bytes --]

Re: [PATCH] mm: larger stack guard gap, between vmas

[Willy Tarreau]

On Thu, Jun 22, 2017 at 01:58:11PM +0100, Ben Hutchings wrote:
> On Thu, 2017-06-22 at 14:46 +0200, Willy Tarreau wrote:
> > On Thu, Jun 22, 2017 at 01:30:45PM +0100, Ben Hutchings wrote:
> > > Here's my attempt at a backport to 3.2.��This is only tested on
> > > x86_64 and I think I should introduce local variables for
> > > vma_start_gap() in a few places.��I had to cherry-pick commit
> > > 09884964335e "mm: do not grow the stack vma just because of an overrun
> > > on preceding vma" before this one (which was a clean cherry-pick).
> > 
> > Ben, I can't apply it on top of 3.2.89 + the patch above, do you have
> > any other patch in your local branch ? For example the patch tries to
> > modify a hunk starting at line 183 of arch/arm/mm/mmap.c while the one
> > I'm having here ends at line 159.
> 
> Sorry, yes, I did this on top of the Debian 3.2 branch and that *does*
> have a patch to arch/arm/mm/mmap.c that I had forgotten about (commit
> 7dbaa466780a "ARM: 7169/1: topdown mmap support").  I think you can
> just drop the changes in ARM's arch_get_unmapped_area_topdown().

Thanks, I've just applied this one and it's building now. I'll run the
same checks I did for 3.10.

Willy

Re: [vs-plain] Re: [PATCH] mm: larger stack guard gap, between vmas

[Levente Polyak]

[-- Attachment #1: PGP/MIME version identification --]
[-- Type: application/pgp-encrypted, Size: 11 bytes --]

[-- Attachment #2: OpenPGP encrypted message --]
[-- Type: application/octet-stream, Size: 12115 bytes --]

-----BEGIN PGP MESSAGE-----

hQIMA88EaVITV8PXAQ/+NuymxttGGakCR2x0OtTPkg9H4T1/8gbResaqROUfWshg
i7j5vBxdMy2pkbDTyA1/IA9hznJqPIyFx376RoGg65lFG5Z4Qjv0z8H6gT75CeB5
8KHPXXysuuBQpwWgE+DL8zRS36xPd/4B2MlhUudHrpZ72PjBPj5EhE//Hy689/gT
8Eji3cskXjSIi12qau/crLVgWIBaGeG4UZ3RxrV9dxbqw7Q8U6H2B/2S049hsPKh
NTxBNaTW0kgBvM3HM5F0V8Lib7OT+vnUucLtHV6UNXfEOvciJVL47ScpKBpF1Esx
VHggwzZ7WxsRLpF5EyKe0WcIrZLtRGxYwXIsCfDJVWc8n/uI6rInlKLt+MDUNoAz
a+1Bv6H5rZfu52BhbxEC/jAZRvHM1XBPV+KixcR5qCK1KXPYgZs00JzV1g3qAoO/
QHLmV5B078+mHdM+lyr3qEZL03P/dZRIoaiM4mzu1CANMxMulE+PesoJvcZwgFue
o6DntxD+GhG52Ra62gx7xoGfNEgwcsOme/pwJK8fw4U5n1IY5Ufy4gWva9FO6tHN
A+EA8xq0Op8iMOhPp6iWGyVEPL89i4aTozyvtJvoCO/nd/R/rwnzojRUYXAF7Y7N
J6MLckNmj4R0PXfa1kiewMvRzkTQNv9nXSdUamDNosceUJPkb+WRFPn2WNR1T4qF
AgwD84FT4nbVR0kBD/kBtX7toV1ByWWdKwFN/0I1Wc4OkTiZlQBp3m+uhKXaPOGf
3wzh76iN6iGogCcZcohE26TTJLkkrWdqMpi6PT9YHhEysBXsB+yjeh0kfUKRlTWx
VEdnmx1LylXlC8qR+ATlVelGvJ/JmYM3u98kWbgB4jniZRm6KxWrPP2bEuC9PGyy
AFYGhnupRd8RtZG+b6i8thEMBjSFNvOgMwzvz2OKAhz3ftsg1zDd5fWLlOUNCC7t
1u2Y6FE1lGjl4sh+hJavt971zF8Mikl+Dgxwm7BPDGEnDqvey3X1noDHXiTFSpBw
NbmdbNnjSSM19Jk7HGf4UuJrlOpx5X8sCdDrCRkfj/o2Nti0n5N8+ml0JB6JdrQ+
szFo0rdRiWZuUzcSoedDeH8ek//kAyHfGiWvVec6BvU0iX0cU8Kq1JvivCZ7Rxop
I0tRu3rv5AfQ8uDV0tIWOAhIKFQP2GvN4ZRNSQDSdxWW+ucc4LCLF6LrrGVfc/qy
9XXgybpwsB/sy9NnQC6Jp8VCEeAqQD2GuvA4T7yl7B+pZ/+OeeLfZgP7t1LwpkcY
qz63vNyOw6T7hIU23jIwlA0aB88V1IYwq6ZTa26Ei4/wht2Nv+sQUZ2VUjKe5BPa
vbWYXoppWmwzBCwOQu+wnIsGMMbZZd+AOFFBUBq9u//GtLQfUz+cw97Ut1kqvYUB
DAPIaYv7kYzkhwEH/2mlpG29YVtpfQQSZyI9cXAD81nwo2aqXo+9tg4rsaPV6+e8
Mz7m+yGnwUF3vs7T9/9zCUdkYKC4ALV7WW++AjxQdWHcSmxAqYWmpny5o9elSxuc
PeZ9HFzdWv/crrExFGCOGOdGPJfV1U0Ju4KEcyXVP1j6QWHXCGXGqHfmCG0OurCT
kBMt9eXXAueKZHuelo2rHleHwcmYD346nYMKtj4/WpQz7aJxRTrgYL4CFV33v9SO
wXngz8opx9L5+Do4b1wgpQnBpA0+YU5Xzb26VSEkrxv0IQcaLH0gkeZmZaAvWitj
6nGcY+9yvUfxL0cKeEQNTRr+b/7RWctogM4YnL+FAgwD0cjmsFTz96UBD/kBW5v6
8Blnarp6wJGTGNL0j8E5ibuFUs1zNLrmQotpszlJ8K+QAZTCYM4ecklNTK5+1Y58
K6YnAjG7bxhfEsjgKumHJz4p6m6RN1RDfPrk2KkOqTiwN3WTT7ZvZ10F981oILzt
3aIeQKN+OFb8Cm1eOSD4gUl2nDbdMvc1qNOjF0rYqTgFDBhqirIrLaayk9FrdrYv
O3Lis5NcIAWonqFpoFdSYXXAzSG/RYRzfanGcIDxbp7h0XeKMn8hBPpXEt1h0Uqs
TSqTw0xNoqmTLkdM8r4vXSil8T/vj+dwXpE6ecu1aH0nbu4MGseCG3CPxFERjqkL
tSoFZYYkOhnDUqXZDUhfrFwHgopOYrkytaYE8/fLdT3+09ueuzL+Db660EtnxNjt
4wcOKP3JNpG6GA3nUd9uTgmK+GnIihrqqF9dnIYMJwGt93JzyoO84zUfu/uaLlVc
jEGZbqvn1F0MFEzJ8yIjwLtu10GJxehr8F88klq/c6AUaLSFQI9MEz9+XSZBJYOk
Ylx+F61b/58mxxpTAvzQAtLdBupTiEh4PMJp/Mxo1jq2c1VUTimOZL0Jnvi+tvyO
IaXeWhANnjA9oQhRUQ20XqhU4lDZWBZK5P1y6fYKd4IFmJUYu9kqsaEwgJs9eNNM
s7hSQkCE4uyljMmGSXvIZhthUPywVqxDKHnihYUCDAPU96ld+x77fwEP+wX7GF01
ryrP/yg90iGMGUUwJCEYnYgxHhLIrjI0sOMCjRtIRbQ9pT91V7zf6fn2QVClqwtk
YK0ZksD+C72hPeiy9XGO1LV2JOR7SCJBxuVz45XL+IfMR7pixMIgoEp90QE1dlr9
Vk0vh3GOdfsguMCPrsln9tz/XkpCj+jTHlMy4v8BbCDzW4jf/9i/L/bgekntSaq7
W3hcFCvtzSQEvUIn7BSBcZVAxtEkCfhDwLTQ2KofNLHQXc9inPvgND6FwlveSJh/
E8HjfT5ZPZr+3JUpIFvSn5PmnVVWJdqXaTemaXe1C32Xshky7qPBDjI+493gGAaW
dqeGpQJiLl8UpVQbCXhlzM5Gy4/yJ26mPVT5qumnSnb0PSgreJz2UndfnJ2UcuHi
Cj3VKMoyOUANS8CqUSULMA9D785yFfNDynNwHxFloWmP/BI0IMG4Qo5IPY1vJF8z
+mAnc0cbaYxCtVVGmEXWXbAuTb3rva/kM0nqfRohXIFmhHaHRCtJsBChf7IVSwxO
isvCaysR5As2rKzmWCmX3c2gg1UZUCPK059+2vbTeoXM9uveqxKvNU5dyMR9Z5X4
e7jGxQ3TlwRsip2GJcmlUfPkG8Q4TCJzJI09iOCqOpk7kUUNnoMBfcFJUfFa7ZYt
drjU5zM1kVmoNON8WTGsbY9e7FxOAMRddYHUhQIMA4UjGzlrlWntAQ//Xt44PgXj
K2HUgY+gSJE1b4vwuI3Tw6rdysrQIsBoZVRWvsIpRJwejDn5vDBjmaJA1ceMY64f
zReqz0cKfDg21SqY8D37DoNCz5eKcbLrWttcvLYpG77xR1wNnl4iafYidrUiv9Rm
+L06Hv8TWiqL4symFjBmDd1F3o+Ve84eW1OeC4L17onqs+3nfJru+tbOwM4Y7xJZ
fmWLZt/tPtRDsGPD7OTaTDXvIX8ULm/hgNfjWRRvP0rwLROOIUq/s+cYT6qlGhme
+1Geys46Z58m/pUFlupnCFvc+QuVzs5f7zRf/nNLNMb1p3zSb79YTN9zOUNYQIqE
qlP3yP2OwxYhp7hqFyfLRQRb+EG1AFjTMqKv3iR9wlzSgsuUesx+hJB4EwsuL6/U
OuKR2aPFmOWlsWd5m/xrRyWTG7DfSHlgCwQy/DRWOMtdkqKyKhRUlyygbBzw3hU/
sbMOHgNMv/iIvU1HHGb0tBJvNBbqqwG82JfARs7SAVURDAAKcoz6WlutbNS2eSfr
2OLc00fS08sEltuLuKOU93xFW8fbotNgiM3oSb44kPDBLKH9jevXKtnDqjA9j56q
kLfpARYnq9nXPic6QIhSC8RXjtdfMXOGWe+YRa6xMTT/h5R5pk5HGeiOsWsskXQ4
F7/w3zYf2iaYgGhcJY0nWKc/o8Sl71O71rmFAQwDrgYmfVN6vWwBB/0YMeEIABY8
F5hCruTefe76qtvIaYr7LrzLIGxoBFoY01ylI+cwoUrxdoWsBVc1pcCgjNW1e6k8
jW8NNB9sPVRyRAruz1176xdRGT3zZtq3RIPN9ZX/D2aUj8MKauIeE0E/WCL24XHZ
lofFyiSRESa/koPC0U3DTaqBe+eqnQw55X+qPaiHvPM6uGTX0xgO0yR27wUq+lmG
wcDITe/W2z1BfsxkrqNSfWg09fO1P2V+0NkoSDSOvyqn+y5CG7PZn7V6MO2GBGjR
JBeOVgbG2l7XAv9SCMyaJzY5Qon7+ZWFfoBl3BH8gQXLU5jCNffPkt6byfgcVscm
gHZmGv6qefIohQEMA4i86A8BL1TKAQf/aUa5wR4KJ9429hX/v8SzuM8mCVz2fNQb
1Cd0E2h9Xih9pItx3wQhbTMtUiEIYutSvBlHroe+PWD3Lv2bR4js/S+Kc5X68fNT
VQCZI5Z//DiBoyjVSoe0MwOsh/WLfaEVb+0HT6BIPTnPCeLJCysN2ohDO02A3OBm
ExGC5zY72L3czBKWoR+bWxuNicP4st9MY8fK6FxyEmsmyGiSaebap4ONmzNNYMVC
LAkaw4edPySBynOfEP2hPdJzXyhiDceJXHLF4iDMTeQyAY8X19wNAo4GBSKZFBO4
1B49KI+8Ya1WVBjJZ3YtkUKFEZhNUzY9ZUqTU+Z8edhT+diNw+SPdYUCDAPGz82c
fsM5pAEP/0sFKpDVAAdV+FhQYCh2keMvk8Eb4WfcJTDVGtyrYhOcWRdYy6vukzKA
XAdwp7o5pjZGzlXdxGKdzd/G2/f2fS5925y2DC5yCCoT5EhLnCkEFGcL4Q7D9h3O
tDmtx1VudyjeHvuJdrRZdI8F1q9DLDd+i0qiyO5T57lN5z68gAA0waAwEhHMl9gg
ojoX1zGSHXJM0cS7JJOjG2sOUeaAEojmlZgCHGjtMi0FbEIY6Xnz8RraxCugAKyy
TJ3oJAGwFyKUtVFQQO5h/Vjd3tUC4x0YDufC1Uvjmfg/I2M6C+bmjQrZs+AXRPN8
E4ps7WTnYNJDuiZHFNsPcAArxHn39mzYdbTv68NPjX6AfIbkQXMtZAWtX264elpJ
Wy/a2N403Rs2rKgQXeN1fImqXd1XlqDY3nWjuXNT4YR1IMTAp3Wwmlt60dXSYEDt
0j9VP988byol0t0If05aA42UZXtJVNlQr1u9IWCPX5fTCr7CG724VaYFhUwvqKNe
Q0THyxJWH3ybuQo5QiC2gSvQ95UQtQZMvjPLTPzO5Oac2/ShOrhxhoK8E1AwS0s6
CBBkVhD/URrtgz/kS3CVwH6swYHo+14i9gc4N6zlbPopvj3bj/jSkmM4raRRx4Hl
1Rh7OQuzB+cVrC4Zalon3Daq0G5YVRuweaZk7exBJVmKseyn4uNLhQEMA4+NHejH
OKLjAQf/afruaLlsfkENEQ6nvJjdm6kxmtA9efLe+VzGdjjEj6cFMW3mtfXJph09
iUNMLeHqbcYo/3WeUkssUu+MvIZotxRvyTzbfH2spBymVHCAiEIsdQ1+ZF8Ep5Eq
sCFMbrrLl6SLXPHaeWX4imxsJvVqcRjNdf0EbwwvtO5HW5mWd43MIG0JcupIc/9G
3gsc8qmohvVOi2T6AjhKwL9CwmppHUvmOPV/UDtXc5OO9QBAysgS0EYGtIA3v/P/
jMNQ4EkXXtbC0DjB+f7L5NFQfj5rg0SajmckjTVUqRi1sDs8VkAPfitSBo3QPvoW
ziJzQXlo5B5pz1gPqqYr7UhPAXKrFYUBDANOWUsxHzLm1wEH/A5FEaVO6TsoujUh
vYS7kYxQQ5CP8GI9fiSmRmvPIsY1SRoHlyrUIkU24pM+EQpjt0rdi6Q6bjs96jfp
dQjIMq9wcFLiEb/e861jDUNf9d3gUA+AkOICmd0VIvz1E57X56m9vynxvzRDGDqc
ukfDBxnzMURO47aN6dUY2MPKs8VRl/Kuqf87SjYnjV6jGov0BXRMUM6vKTdokOqz
PMwVDqSxBeZGeuJN8MR9abOhj1SbdqxQnwbuCcyk+6uZ3BeXRGfnxS+9LKtgWyLt
w94Cjx4rKfHJRMpG3LTkjXr0nwHLr/ZAtg1a7z+oQZj2vMeMYxDl4xaiTcXKa23v
mvqjwZyFAQwD2ypt/39wdbQBCAC2uqzBz7hxN8NvJ/QvMI3gTT1S+uhsVMZVd+Ur
iFFydWVdjKeezkyqJcO7lmD66kV+hYh2Wy6f/2swy0wkUcH0sUYQ6cWJXJqogEsH
P/emCz4tygqYqaUDKCgmc5UV9Iaws3jODvIBg0LMGWRZwJGKDK108hRENMiw+J4s
Cuf9mz4JSeC0wjxUacrjH33IXFbG1+V7SXA3uEJKTGElpf9Xwbxy4AGBLLa05wxN
mNzXi39VeqivEO8tvd7VPrFxGp/A2O1d1zHck3vg+wOj8w2D+UnDMdPJLAJ0iJj2
9+LwrBlUN7YHAqspkTqWAlU+ADwESAPI2KPNKTEYksP0ouFjhQIMA0GDcp9eHiJn
AQ/9HLCGXx8Yc1wq4bJhlVvFdLUIiSWt7+S1uKbuJRcqIj1d/y1k2x2OIOP/Vv0S
4nJELw2O4cvywM9qKrPN6AWxFf/bWDi7LO7FLuSmClL5KLmT5f5cSNXRzCUH/fd+
Y2qiAkt8nc50HsvOCYskoOXk9wMq1e6Z3lu5PssVqUxPotc7zbrFeOrXlq80P78M
meDp2S7ykgzeGhgbaZhi7zPrbtFR329uzje0S+wtpfx+BQpYC7YoZ+tqhlUlFt4r
QmJ776Z86EiC71PEjT+bdEQqBw/4ul3R+gm4RW2SGljrVTySSDS0eSXhFgGJe9Ci
k1A1yk40GBz5vOZSEp8kabHuzht1RYXVvL5RVOIWNvPqrPlsQAEFCxaUpPYdqcfG
LHnfE36W56e/ZCT3l5LZOzjK2v+qtj3huNU/cxMmRI9y4ea5C3M3EqLr4jQ4vLEJ
tgbgW07nkEtyknzyYhSIrkxBojVPpymB7Df8UYW4NWbMfwLuuj/IQ/yaZTzpkWGg
lX5pXUN0+b1J3xieDAMauFN6qgkw0VgogkjtAL4QpQpwjpz2SA1R9DEMQV/pIEbX
HIHqv0kgwufISVGefWHTX1oDckwOT6w/+Xpx2yHfuFFbtDmrn3Ooam1MDc77USem
jiBPKBFHQhEkKNqvPU9QwHMKVX9cXWi+cRSqGWF4uBt4L8eFAgwDAUGAx+hBlnIB
D/9cLHLHqm1P/Y+zReina8884siueZFhPgy+8OHTbqkI/KgXtyXUVipd6DWrsYBY
uLfxcxD5SpoPhnxg1+Gip3gDXqFfqPsOffffZI1zGD+JNQ0WLsXVZK1/sYht4zRH
HynwNoTx/yFuOc2GkvdR8mHMhsWa/sOCpG/vwYVs3ZSAkUAJrwYzmlXuFpm/3p4v
Pegi8y/DdIBtkZsZyqa6zP5+z/UoAGzCy99sIin0M6oMWiyRTSRmcCE0dIFr1DXs
XGp3VeRzACKHUD1Wi8UbRDGnt6SNL742Exs5t+HKIs/X7TnAx2XEHAzE5kQEGoPL
txBtBuZJfbxjON1eZU2LyyMOw0+ms0rrOXQ2i02dJy6r5zSR8njXgxVVijKci5y4
gwlozdrjxdNK3cHGvE6vneof6KbERcjnUnV09MdBgt3vmhmlNnc+PVq5C6BdQOrt
ny5gV4B0xXHdyj7QB6wkkKFBNmnI27gnw5BivUiR0E4NcbGZMU3egFlhQKaoZ/+A
hyFAQ4IhTNiyoLMaMxAgbYUg6ljVNXslxAhWFLJLgVwZOj699fsOl7SA1TxEMffg
mLI/YYxvQA/vKesBaSI2dIS68+/77DamuZaBOceGQreguaFLGPLauXTylCkq6VOS
PUWyZLgXjbNJT+aaTH875ptvBWBzUh00eImp0lh4eEEitYUCDAOtBVSAQddkyAEP
+wckrdyE+eB8VfgGZpmalm2babpzeFiOoS4Q4O59/mWI6Sigy5K6/uo/NXwimWAe
j5tUNamAdl13/QVS4bpft5nPcN8C8pCuxAqOGl79FxmqsluzQKg4u3M1ERB9+umJ
jM3yuDNguVA4ZW3MmmHpc82R4OS+f2uv0IVs3qwcteBV2ZvLwKOpcZN4ZmEFfwyO
9e73tmbp+0cHz3B8mg5m8ERTcG/mEaMfQ0vAskJC3jX9JRSQg6ei8SHGGp+Lkbus
y2lnJNJlmeznZFQ5nFIUrGVw/g/K6pB11GW8Onbdk4zSLtWWV9ulH/SUABRXI3yG
uks/Gg5q8dDNoQDL8DZB/kGzVRmVFMc8/wNvWmHZ6KJlEr/WUuimTAtiw9zROyKc
tKfT5HzE1l8LZKu+Uw7GQfMufiVC56o7EDMMsPOpw/cvLtQMLs2mB/mgNhtqUIAK
SHht1x7rmgiByECAi735eo2L5Cu+3pQz5Kao3QExyscrBaTK+N3w9mZY5SusDAKS
tqj5w7ITlzH6SQ+9kPhGKxIUWzBZAB8nYhKkJ3uuN2QUofq0JVA7F7lJRMuObjJL
gpCkNe0p4SpmKTNS3cYzd80ccdmbdlLOHtEOeOt+GKUZU079vYWiykXBZyN5X1AM
lZMO/59inP9qg1WTVHv2XwVX6BP/MQ9VsQT2L++7uL1R0usBneKzTJLEkk13wPja
YK4OvhaPgPOMfHtSBPo4mYGCXxaecucpLNRFjxNdWCi/E7z/lxuppiaHcbbBHrIJ
l+AO1Jz83S73rOHzJawJSdboPUjUXAcs3jzkvPqOoDB+7Vmj9XqgIQLk6yOplmPv
Z9faR/YKOuM9JLMf/2SwkGADv/moCqfD6rmNqUsYi/mZh0+z/wvm1SdtnczKA/jn
lRlTIKwO9zpmjcuzoa+BQnRJ1bLV/ZOc6It55nwe9HbaqwXnyrfs10n3TKOJCcI3
hjSKRjl34v7wRxIuG2BEUhJg0I7pDvxAXjEidyrNgF+qvM7aL5QG6IkAkRfnUvmg
MlT824AUQrVivCOjqh6SLz3ocXNqOv2aRQ4+Xw2oSS8z2yIMnhrq/TP7QMhsTh0/
iF7OruUpsSFJQ4syBZccnTq3kF91SABW+WoPcx9lCPNjllT6dSZhxompAkGAVdc6
o0NzDS7A0TisjCWR5vdpuzZv5YT7tPSxBqzOre8catnJjZodWFiRLmCgJtmoPqKv
wPA2mkXbBONIftZpyC3ur38ukMkd2yAOWS3Ggr8FsMK0qpyBq8MUJ+OBS097OJLf
jP+ifpy+7blBEmQMuYKNofLz/MNcMMgfgE2/dgXUcI/FCoJIC8t+tWp7Onr/fwHF
3lkIO2EEW5k/83SqAdV+fu0V0AL+FiTKvfDAmyE7oSScBd1C4fEMcdB4Gsh/vNcJ
inSR4U6Zdc2lcQ+ZXEGM1kr1qjy5sA1f6r0bkhDX7GvUp5GYlfJNRbIcsfAGxNJs
HwRmFK/Mj9S9l+38Zlm3bld4zJNsW3Gxczm1lYmj/hgKPUvOXnV1qSk0E1Gq87EE
bC97TL9sK/QbCbwlmBECmMwcZaV3pmrs9w5w2op+Ig4N68j9kMHkGLqo9eEE30yJ
0p8F0nLZGwI2MNb1oGnHGzf5O9S7ENCBWknK38XEvqzsJwcSJpueKX9EGSVlGJ8O
YU5DqcJ37X+5f6Ra3Tmkn1P/TJmMWOEhf7t8j9RX55wHGFNnlACmWUMFLM0nj/Nq
mZEkE0xvJz3iZBp/H0/suuf80GFS9UxukChnaYVo5NSvaWlqZl/9tF68cfBPQ982
RoyestG1pKi7h5vXY4C8hbzqhvIuDs4MoPLZHYtI9Bkcsob7Y0dywZZ6fUYPJ+q2
IpRU2riSPUV+fNTJQH9LHFbycPV2u6UySfomF/P0zOVis23YQq1WvoScjFt867Vy
Z8nZIlm7UxK2AcXORo9SYSHy/13Xf3wpVnbYdE0Ji9agwY0BTefS/HMCYtA+5BF+
3RcXPqjCSWOd/7zdItHi26gTsB/QUL/iDB5S1p7rnjRf9ZEzP6gMWwPxUZQy//0O
7lnJoeWxe5Nm9bIvezEq1i6RF2EFWdAC1i0XFbz7lWkY4pz0RKbv5wugROVYZamn
YylSs6CsaGXvG7WlfqJ+ndNbUPA3d50dsHT912SrWem5PCDJvCfZnp9VFlcm5QL7
ZWJJ7oNhXVWSrNr+rh/fjMe2KMdJkeRxWNTIGPKTycFp0STfrrcpE/AR6BQgze8t
WwMvaarUrjXp3+LTXT+du1f2RA28Quo+W2v5rDNLDNR7jkhwM7lIakHewHJOEHS0
qwPn8zQFjBCM8Q/xrjfKIEaxFri6b/ueRISmokRJTAH8zeCSxptV9O7rmJM4cnav
nTHu5RKfBwbdyHi71uNaxscjnukJP1YDMjMf/hb/pSi6RwUmDXbEtBNE5bbizMru
h1vs4ZyPzXV6Awk90E7kOUYTqXTGkPfBJuPCatWh/BRXJAYD2HsrqEn2iOzY5lGp
XGzMzOyZdusPK21V5OyhVJRBp++IQVLymgADIZ//j23X5kwL0b38KBj4jFK+VV+A
Zj1r87g6bpN19qPJhONO/hOq9NxHQDwqXg7JIx177VvJa6UM7Xw9SztGAc0WEPDB
YFV+QGDSOEYAuDxraJYJ68lK3jqD2IxiS3le1wlplEHd2cYnmFpKHcRU0QpY5yrY
3wJoS1quKDFlxNIfDSRePSXr9tFYpy8kZnX7H1jdOgE5KOBzWiyxbsipWBAFP8eF
QMl0fI+aZ/1icIw4tQnTIwSsXeUc1dQRGW3OeGWql0Zxpd8puilLZ7HVJmmmByaB
QinTwjpDA4dYVQmBvMIFRUnMwbdE7n6VUKdytHvX7zMSvCG528AXHYoS7RFmgpxK
AZyJayl95A+cgp8UaBptMmMwF65LPVog0wV/qu0C2s1QySe1PA06F1Z+wihgvloJ
tnDSx7xtS/phj/M/lMXcx/aoQ3evec+tUJ2ZwcVpGJqGVFJtsOi0ohtNdawJwvsL
hA/zt9yaOhpRfnIN6q7N9llly2JCGo6WVaUvM2Er2Ow+5QsDOTlNtdEs8oN60lMb
0ZQrhmKob8bnFObU9ZrFKEhBOzFHAdHmSAH3FPiq5muRiT4fwEN355fU+r5Qy1N8
eTDc59pUlg5OC9AXqVGLXHhr0bNHYfDV0tIbU8N9J2xKVvmV5MrLbBAT43TbJQjc
CTTEO5QQzFTHMu17C4AKh0jBUYYP47RjjIbUOrkL+L4QQqgvtuiWs8EHlV2CW+hK
kmvWmMpR7QLQKRKr1x9V6KBTIYCxyK0FoZUBNmTSBbql5ggvVe771vVhM6HhlH8i
Tc+6lYUzH18oQdBkiVjMW6sCdF/xcvVjjAxiYgZ08KTkhPEEB4/fXhR0O9AiEI+n
B3I/8umWnsUSDxPzWh0gr0rL8MEfk4ujIVmLlREjBOMGK43nbOGu0K74dbDkNqR4
JF+0GbqLTyy+dSj/EizOGT4+zqLkItJVjTFeNaL+EWu242Mc8mtSAFsa7+BdZgrJ
ENX/2UAmRVp9QezAFWRaD0785y6zG4qGUozR6HaskGENp/+XJdAFH3v1txs8hZ6u
mWEZwEMGyJH3t9crq2s+DOakFp/2trCD+Qop9NMGtNY350Q9CAeR4uQ3lqCdUjWy
E2tTmQeFJsx4fWpiHIBI9hHj1Sz2zYUCE02Vkl1a98/8gwuSUPM4Nnm7SaobKd87
woHhVzmpjZ6NpGRzanCsbvrOOs0tzEzirqjRPEFaOg4fkygwDBXu6CYzvt53/Lcf
6gsMkhWdgV9DV2eHpyzCKa63U+IaAM/g0RcCrPc6pjouteWBX1kU2rxTm8pcb3ss
JpM9gqxRRaLtMqAhZacxWmGGKXwzOqcrpJrAW/Wx+v9Z1gsB+EwLKH47zqG3vqxD
+7k6E+serevKu55eZmtYUfEigQey4gxPOXGsLECjGXvwfCqJo3EtPRrVyMWEY30x
N8SIAAs/edzt70uBByeaCJw66yNs/06MaWcgTGDpXc/OM3yKZDAMv5GS3IWKO4mY
xgIxA6mZNvoJBtc0ya8NQ+vEY0Y=
=Jf8L
-----END PGP MESSAGE-----

Re: [PATCH] mm: larger stack guard gap, between vmas

[Willy Tarreau]

On Thu, Jun 22, 2017 at 03:10:34PM +0200, Willy Tarreau wrote:
> On Thu, Jun 22, 2017 at 01:58:11PM +0100, Ben Hutchings wrote:
> > On Thu, 2017-06-22 at 14:46 +0200, Willy Tarreau wrote:
> > > On Thu, Jun 22, 2017 at 01:30:45PM +0100, Ben Hutchings wrote:
> > > > Here's my attempt at a backport to 3.2.��This is only tested on
> > > > x86_64 and I think I should introduce local variables for
> > > > vma_start_gap() in a few places.��I had to cherry-pick commit
> > > > 09884964335e "mm: do not grow the stack vma just because of an overrun
> > > > on preceding vma" before this one (which was a clean cherry-pick).
> > > 
> > > Ben, I can't apply it on top of 3.2.89 + the patch above, do you have
> > > any other patch in your local branch ? For example the patch tries to
> > > modify a hunk starting at line 183 of arch/arm/mm/mmap.c while the one
> > > I'm having here ends at line 159.
> > 
> > Sorry, yes, I did this on top of the Debian 3.2 branch and that *does*
> > have a patch to arch/arm/mm/mmap.c that I had forgotten about (commit
> > 7dbaa466780a "ARM: 7169/1: topdown mmap support").  I think you can
> > just drop the changes in ARM's arch_get_unmapped_area_topdown().
> 
> Thanks, I've just applied this one and it's building now. I'll run the
> same checks I did for 3.10.

So I tested this with gap.c on an i386 VM running 2G/2G split memory, all
went fine. It properly stopped the stack growth before colliding with anon
pages.

I noticed that you included Hugh's last fix in it (mm: fix new crash in
unmapped_area_topdown). You'll also need Helge's fix bd726c90b ("Allow
stack to grow up to address space limit"), which applies without issues
on top of your patch.

I would have happily tested on an ARM board but I don't seem to have
3.2-compatible ARM boards with 2G of RAM :-/

Willy

Re: [vs-plain] Re: [PATCH] mm: larger stack guard gap, between vmas

[Willy Tarreau]

Hi,

On Thu, Jun 22, 2017 at 03:15:51PM +0200, Levente Polyak wrote:
> Just a side note, but i think its worth mentioning to also have look at
> these fixup patches:
> 
> 
> -- mm: fix new crash in unmapped_area_topdown()
> https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=f4cb767d76cf7ee72f97dd76f6cfa6c76a5edc89

As I mentionned in another mail (this thread starts to be huge), this
one seems to have already been included in Ben's backport.

> -- Allow stack to grow up to address space limit
> https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=bd726c90b6b8ce87602208701b208a208e6d5600

This one cleanly applies after, but I think Ben is currently looking
for feedback on the validity of his backport which was a difficult task.

Regards,
Willy

Re: [vs-plain] Re: [PATCH] mm: larger stack guard gap, between vmas

[Ben Hutchings]

[-- Attachment #1: Type: text/plain, Size: 1126 bytes --]

On Thu, 2017-06-22 at 15:59 +0200, Willy Tarreau wrote:
> Hi,
> 
> On Thu, Jun 22, 2017 at 03:15:51PM +0200, Levente Polyak wrote:
> > Just a side note, but i think its worth mentioning to also have
> > look at
> > these fixup patches:
> > 
> > 
> > -- mm: fix new crash in unmapped_area_topdown()
> > https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/
> > commit/?id=f4cb767d76cf7ee72f97dd76f6cfa6c76a5edc89
> 
> As I mentionned in another mail (this thread starts to be huge), this
> one seems to have already been included in Ben's backport.

That code was completely replaced due to the lack of an rbtree for gaps
in 3.2, so the fix was not needed.

> > -- Allow stack to grow up to address space limit
> > https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/
> > commit/?id=bd726c90b6b8ce87602208701b208a208e6d5600
> 
> This one cleanly applies after, but I think Ben is currently looking
> for feedback on the validity of his backport which was a difficult
> task.

Right.

Ben.

-- 
Ben Hutchings
Sturgeon's Law: Ninety percent of everything is crap.


[-- Attachment #2: This is a digitally signed message part --]
[-- Type: application/pgp-signature, Size: 833 bytes --]

Re: [vs-plain] Re: [PATCH] mm: larger stack guard gap, between vmas

[Willy Tarreau]

On Thu, Jun 22, 2017 at 03:14:00PM +0100, Ben Hutchings wrote:
> On Thu, 2017-06-22 at 15:59 +0200, Willy Tarreau wrote:
> > but I think Ben is currently looking
> > for feedback on the validity of his backport which was a difficult
> > task.
> 
> Right.

Ben, barring more feedback, I think your should put your patch to your
stable queue so that Guenter can run his build+boot tests. They managed
to spot a few issues in my patches and that will make you more confident
regarding the whole architectures coverage.

Just my 2c,
Willy

Re: [vs-plain] Re: [PATCH] mm: larger stack guard gap, between vmas

[Helge Deller]

On 22.06.2017 16:14, Ben Hutchings wrote:
> On Thu, 2017-06-22 at 15:59 +0200, Willy Tarreau wrote:
>>> -- Allow stack to grow up to address space limit
>>> https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/
>>> commit/?id=bd726c90b6b8ce87602208701b208a208e6d5600
>>
>> This one cleanly applies after, but I think Ben is currently looking
>> for feedback on the validity of his backport which was a difficult
>> task.
> 
> Right.

Ben,
I might be able to give it a try, but I'm not sure if I'm able to boot
that kernel on my parisc box. Kernel 3.9 was basically the first one
which was run basically stable on parisc, but since then we had
some ABI changes in userspace (reduced SIGRTMIN, made
EWOULDBLOCK == EAGAIN) which might prevent me to boot that
kernel with current glibc.
Anyway, can you point me to your patches ?

Helge

Re: [vs-plain] Re: [PATCH] mm: larger stack guard gap, between vmas

[Andy Lutomirski]

On Thu, Jun 22, 2017 at 7:34 AM, Willy Tarreau <w@1wt.eu> wrote:
> On Thu, Jun 22, 2017 at 03:14:00PM +0100, Ben Hutchings wrote:
>> On Thu, 2017-06-22 at 15:59 +0200, Willy Tarreau wrote:
>> > but I think Ben is currently looking
>> > for feedback on the validity of his backport which was a difficult
>> > task.
>>
>> Right.
>
> Ben, barring more feedback, I think your should put your patch to your
> stable queue so that Guenter can run his build+boot tests. They managed
> to spot a few issues in my patches and that will make you more confident
> regarding the whole architectures coverage.
>

Has anyone checked how grsecurity deals with this?  I think they have
a large stack guard gap.

--Andy

Re: [PATCH] mm: larger stack guard gap, between vmas

[Hugh Dickins]

On Thu, 22 Jun 2017, Ben Hutchings wrote:

> Here's my attempt at a backport to 3.2.  This is only tested on
> x86_64 and I think I should introduce local variables for
> vma_start_gap() in a few places.  I had to cherry-pick commit
> 09884964335e "mm: do not grow the stack vma just because of an overrun
> on preceding vma" before this one (which was a clean cherry-pick).

Both your speed and your stamina are much better than mine; and your
patch belies your Sturgeon's law signature.  I haven't got beyond the
architectures yet in my parallel attempt, and you do appear to be
doing everything right (but a local variable often welcome, yes).

I'm giving up for the night, will contine tomorrow.
The only discrepancy I notice so far is that I have
arch/alpha/kernel/osf_sys.c
arch/ia64/mm/hugetlbpage.c
arch/sparc/kernel/sys_sparc_32.c
in my list of changed files, but they're not in yours.

Hugh

Re: [vs-plain] Re: [PATCH] mm: larger stack guard gap, between vmas

[Linus Torvalds]

On Thu, Jun 22, 2017 at 8:10 PM, Andy Lutomirski <luto@kernel.org> wrote:
>
> Has anyone checked how grsecurity deals with this?  I think they have
> a large stack guard gap.

Don't bother with grsecurity.

Their approach has always been "we don't care if we break anything,
we'll just claim it's because we're extra secure".

The thing is a joke, and they are clowns. When they started talking
about people taking advantage of them, I stopped trying to be polite
about their bullshit.

Their patches are pure garbage.

                  Linus

Re: [PATCH] mm: larger stack guard gap, between vmas

[Hugh Dickins]

On Thu, 22 Jun 2017, Hugh Dickins wrote:
> On Thu, 22 Jun 2017, Ben Hutchings wrote:
> 
> > Here's my attempt at a backport to 3.2.  This is only tested on
> > x86_64 and I think I should introduce local variables for
> > vma_start_gap() in a few places.  I had to cherry-pick commit
> > 09884964335e "mm: do not grow the stack vma just because of an overrun
> > on preceding vma" before this one (which was a clean cherry-pick).
> 
> Both your speed and your stamina are much better than mine; and your
> patch belies your Sturgeon's law signature.  I haven't got beyond the
> architectures yet in my parallel attempt, and you do appear to be
> doing everything right (but a local variable often welcome, yes).
> 
> I'm giving up for the night, will contine tomorrow.
> The only discrepancy I notice so far is that I have
> arch/alpha/kernel/osf_sys.c
> arch/ia64/mm/hugetlbpage.c
> arch/sparc/kernel/sys_sparc_32.c
> in my list of changed files, but they're not in yours.

And here's my attempt at a backport to 3.2.89, at last.
I know it builds and boots and runs on x86 64 and 32,
but that's about all that I've tried.

If you diff against yours (I preferred not to send that diff,
because of the couple of rejects in yours against 3.2.89),
you'll find most of the difference is just noise from where
I used a variable, but you had not yet done so in yours.

But there are those three missing files, and there are a few
places where I have a little "if (prev) {" block at the head of
the loop after find_vma_prev(): I think those loops start off
wrongly without that.

I notice now that you don't use find_vma_prev() in your generic
(mm/mmap.c) arch_get_unmapped_area() and _topdown(): and now
that I reflect on it, I think you're perfectly correct to keep
those simple (especially given the inefficient implementation
of find_vma_prev() in 3.2 - only later was it changed to make
use of vm_prev), since both ia64 and parisc provide their own
arch_get_unmapped_area() in this release, and neither use the
_topdown().

Whereas I spent much too much time on adapting those generics
to vm_end_gap(), and pretty much gave up on the _topdown() -
it grieved me to end up calling find_vma_prev() each time
around the loop (where before it called find_vma() each time
around the loop), there is definitely better use to be made
of vm_prev there, but too hard to get right as I grew tired.

So please at least take a look through the diff from yours, I
think you'll find a few things to bring in, but a lot to ignore.

Hugh

diff -purN 302s/arch/alpha/kernel/osf_sys.c 302h/arch/alpha/kernel/osf_sys.c
--- 302s/arch/alpha/kernel/osf_sys.c	2011-10-24 00:10:05.000000000 -0700
+++ 302h/arch/alpha/kernel/osf_sys.c	2017-06-22 18:16:22.425283525 -0700
@@ -1147,7 +1147,7 @@ arch_get_unmapped_area_1(unsigned long a
 		/* At this point:  (!vma || addr < vma->vm_end). */
 		if (limit - len < addr)
 			return -ENOMEM;
-		if (!vma || addr + len <= vma->vm_start)
+		if (!vma || addr + len <= vm_start_vma(vma))
 			return addr;
 		addr = vma->vm_end;
 		vma = vma->vm_next;
diff -purN 302s/arch/arm/mm/mmap.c 302h/arch/arm/mm/mmap.c
--- 302s/arch/arm/mm/mmap.c	2012-01-04 15:55:44.000000000 -0800
+++ 302h/arch/arm/mm/mmap.c	2017-06-23 21:30:38.061880299 -0700
@@ -30,7 +30,7 @@ arch_get_unmapped_area(struct file *filp
 {
 	struct mm_struct *mm = current->mm;
 	struct vm_area_struct *vma;
-	unsigned long start_addr;
+	unsigned long start_addr, vm_start;
 	int do_align = 0;
 	int aliasing = cache_is_vipt_aliasing();
 
@@ -62,7 +62,7 @@ arch_get_unmapped_area(struct file *filp
 
 		vma = find_vma(mm, addr);
 		if (TASK_SIZE - len >= addr &&
-		    (!vma || addr + len <= vma->vm_start))
+		    (!vma || addr + len <= vm_start_gap(vma)))
 			return addr;
 	}
 	if (len > mm->cached_hole_size) {
@@ -96,15 +96,17 @@ full_search:
 			}
 			return -ENOMEM;
 		}
-		if (!vma || addr + len <= vma->vm_start) {
+		if (vma)
+			vm_start = vm_start_gap(vma);
+		if (!vma || addr + len <= vm_start) {
 			/*
 			 * Remember the place where we stopped the search:
 			 */
 			mm->free_area_cache = addr + len;
 			return addr;
 		}
-		if (addr + mm->cached_hole_size < vma->vm_start)
-		        mm->cached_hole_size = vma->vm_start - addr;
+		if (addr + mm->cached_hole_size < vm_start)
+			mm->cached_hole_size = vm_start - addr;
 		addr = vma->vm_end;
 		if (do_align)
 			addr = COLOUR_ALIGN(addr, pgoff);
diff -purN 302s/arch/frv/mm/elf-fdpic.c 302h/arch/frv/mm/elf-fdpic.c
--- 302s/arch/frv/mm/elf-fdpic.c	2007-07-08 16:32:17.000000000 -0700
+++ 302h/arch/frv/mm/elf-fdpic.c	2017-06-22 18:27:22.823308633 -0700
@@ -74,7 +74,7 @@ unsigned long arch_get_unmapped_area(str
 		addr = PAGE_ALIGN(addr);
 		vma = find_vma(current->mm, addr);
 		if (TASK_SIZE - len >= addr &&
-		    (!vma || addr + len <= vma->vm_start))
+		    (!vma || addr + len <= vm_start_gap(vma)))
 			goto success;
 	}
 
@@ -89,7 +89,7 @@ unsigned long arch_get_unmapped_area(str
 			for (; vma; vma = vma->vm_next) {
 				if (addr > limit)
 					break;
-				if (addr + len <= vma->vm_start)
+				if (addr + len <= vm_start_gap(vma))
 					goto success;
 				addr = vma->vm_end;
 			}
@@ -104,7 +104,7 @@ unsigned long arch_get_unmapped_area(str
 		for (; vma; vma = vma->vm_next) {
 			if (addr > limit)
 				break;
-			if (addr + len <= vma->vm_start)
+			if (addr + len <= vm_start_gap(vma))
 				goto success;
 			addr = vma->vm_end;
 		}
diff -purN 302s/arch/ia64/kernel/sys_ia64.c 302h/arch/ia64/kernel/sys_ia64.c
--- 302s/arch/ia64/kernel/sys_ia64.c	2010-02-24 10:52:17.000000000 -0800
+++ 302h/arch/ia64/kernel/sys_ia64.c	2017-06-23 21:31:37.581321626 -0700
@@ -27,7 +27,8 @@ arch_get_unmapped_area (struct file *fil
 	long map_shared = (flags & MAP_SHARED);
 	unsigned long start_addr, align_mask = PAGE_SIZE - 1;
 	struct mm_struct *mm = current->mm;
-	struct vm_area_struct *vma;
+	struct vm_area_struct *vma, *prev;
+	unsigned long prev_end;
 
 	if (len > RGN_MAP_LIMIT)
 		return -ENOMEM;
@@ -58,7 +59,17 @@ arch_get_unmapped_area (struct file *fil
   full_search:
 	start_addr = addr = (addr + align_mask) & ~align_mask;
 
-	for (vma = find_vma(mm, addr); ; vma = vma->vm_next) {
+	for (vma = find_vma_prev(mm, addr, &prev); ; prev = vma,
+						vma = vma->vm_next) {
+		if (prev) {
+			prev_end = vm_end_gap(prev);
+			if (addr < prev_end) {
+				addr = (prev_end + align_mask) & ~align_mask;
+				/* If vma already violates gap, forget it */
+				if (vma && addr > vma->vm_start)
+					addr = vma->vm_start;
+			}
+		}
 		/* At this point:  (!vma || addr < vma->vm_end). */
 		if (TASK_SIZE - len < addr || RGN_MAP_LIMIT - len < REGION_OFFSET(addr)) {
 			if (start_addr != TASK_UNMAPPED_BASE) {
@@ -68,12 +79,11 @@ arch_get_unmapped_area (struct file *fil
 			}
 			return -ENOMEM;
 		}
-		if (!vma || addr + len <= vma->vm_start) {
+		if (!vma || addr + len <= vm_start_gap(vma)) {
 			/* Remember the address where we stopped this search:  */
 			mm->free_area_cache = addr + len;
 			return addr;
 		}
-		addr = (vma->vm_end + align_mask) & ~align_mask;
 	}
 }
 
diff -purN 302s/arch/ia64/mm/hugetlbpage.c 302h/arch/ia64/mm/hugetlbpage.c
--- 302s/arch/ia64/mm/hugetlbpage.c	2011-03-14 18:20:32.000000000 -0700
+++ 302h/arch/ia64/mm/hugetlbpage.c	2017-06-22 20:50:22.569517894 -0700
@@ -171,9 +171,9 @@ unsigned long hugetlb_get_unmapped_area(
 		/* At this point:  (!vmm || addr < vmm->vm_end). */
 		if (REGION_OFFSET(addr) + len > RGN_MAP_LIMIT)
 			return -ENOMEM;
-		if (!vmm || (addr + len) <= vmm->vm_start)
+		if (!vmm || (addr + len) <= vm_start_gap(vmm))
 			return addr;
-		addr = ALIGN(vmm->vm_end, HPAGE_SIZE);
+		addr = ALIGN(vm_end_gap(vmm), HPAGE_SIZE);
 	}
 }
 
diff -purN 302s/arch/mips/mm/mmap.c 302h/arch/mips/mm/mmap.c
--- 302s/arch/mips/mm/mmap.c	2011-10-24 00:10:05.000000000 -0700
+++ 302h/arch/mips/mm/mmap.c	2017-06-22 20:34:16.758377572 -0700
@@ -70,6 +70,7 @@ static unsigned long arch_get_unmapped_a
 	struct mm_struct *mm = current->mm;
 	struct vm_area_struct *vma;
 	unsigned long addr = addr0;
+	unsigned long vm_start;
 	int do_color_align;
 
 	if (unlikely(len > TASK_SIZE))
@@ -103,7 +104,7 @@ static unsigned long arch_get_unmapped_a
 
 		vma = find_vma(mm, addr);
 		if (TASK_SIZE - len >= addr &&
-		    (!vma || addr + len <= vma->vm_start))
+		    (!vma || addr + len <= vm_start_gap(vma)))
 			return addr;
 	}
 
@@ -118,7 +119,7 @@ static unsigned long arch_get_unmapped_a
 			/* At this point:  (!vma || addr < vma->vm_end). */
 			if (TASK_SIZE - len < addr)
 				return -ENOMEM;
-			if (!vma || addr + len <= vma->vm_start)
+			if (!vma || addr + len <= vm_start_gap(vma))
 				return addr;
 			addr = vma->vm_end;
 			if (do_color_align)
@@ -145,7 +146,7 @@ static unsigned long arch_get_unmapped_a
 		/* make sure it can fit in the remaining address space */
 		if (likely(addr > len)) {
 			vma = find_vma(mm, addr - len);
-			if (!vma || addr <= vma->vm_start) {
+			if (!vma || addr <= vm_start_gap(vma)) {
 				/* cache the address as a hint for next time */
 				return mm->free_area_cache = addr - len;
 			}
@@ -165,20 +166,22 @@ static unsigned long arch_get_unmapped_a
 			 * return with success:
 			 */
 			vma = find_vma(mm, addr);
-			if (likely(!vma || addr + len <= vma->vm_start)) {
+			if (vma)
+				vm_start = vm_start_gap(vma);
+			if (likely(!vma || addr + len <= vm_start)) {
 				/* cache the address as a hint for next time */
 				return mm->free_area_cache = addr;
 			}
 
 			/* remember the largest hole we saw so far */
-			if (addr + mm->cached_hole_size < vma->vm_start)
-				mm->cached_hole_size = vma->vm_start - addr;
+			if (addr + mm->cached_hole_size < vm_start)
+				mm->cached_hole_size = vm_start - addr;
 
 			/* try just below the current vma->vm_start */
-			addr = vma->vm_start - len;
+			addr = vm_start - len;
 			if (do_color_align)
 				addr = COLOUR_ALIGN_DOWN(addr, pgoff);
-		} while (likely(len < vma->vm_start));
+		} while (likely(len < vm_start));
 
 bottomup:
 		/*
diff -purN 302s/arch/parisc/kernel/sys_parisc.c 302h/arch/parisc/kernel/sys_parisc.c
--- 302s/arch/parisc/kernel/sys_parisc.c	2017-06-20 16:22:15.561319552 -0700
+++ 302h/arch/parisc/kernel/sys_parisc.c	2017-06-23 21:35:09.003338157 -0700
@@ -35,17 +35,27 @@
 
 static unsigned long get_unshared_area(unsigned long addr, unsigned long len)
 {
-	struct vm_area_struct *vma;
+	struct vm_area_struct *vma, *prev;
+	unsigned long prev_end;
 
 	addr = PAGE_ALIGN(addr);
 
-	for (vma = find_vma(current->mm, addr); ; vma = vma->vm_next) {
+	for (vma = find_vma_prev(current->mm, addr, &prev); ; prev = vma,
+							vma = vma->vm_next) {
+		if (prev) {
+			prev_end = vm_end_gap(prev);
+			if (addr < prev_end) {
+				addr = prev_end;
+				/* If vma already violates gap, forget it */
+				if (vma && addr > vma->vm_start)
+					addr = vma->vm_start;
+			}
+		}
 		/* At this point:  (!vma || addr < vma->vm_end). */
 		if (TASK_SIZE - len < addr)
 			return -ENOMEM;
-		if (!vma || addr + len <= vma->vm_start)
+		if (!vma || addr + len <= vm_start_gap(vma))
 			return addr;
-		addr = vma->vm_end;
 	}
 }
 
@@ -70,22 +80,32 @@ static int get_offset(struct address_spa
 static unsigned long get_shared_area(struct address_space *mapping,
 		unsigned long addr, unsigned long len, unsigned long pgoff)
 {
-	struct vm_area_struct *vma;
+	struct vm_area_struct *vma, *prev;
+	unsigned long prev_end;
 	int offset = mapping ? get_offset(mapping) : 0;
 
 	offset = (offset + (pgoff << PAGE_SHIFT)) & 0x3FF000;
 
 	addr = DCACHE_ALIGN(addr - offset) + offset;
 
-	for (vma = find_vma(current->mm, addr); ; vma = vma->vm_next) {
+	for (vma = find_vma_prev(current->mm, addr, &prev); ; prev = vma,
+							vma = vma->vm_next) {
+		if (prev) {
+			prev_end = vm_end_gap(prev);
+			if (addr < prev_end) {
+				addr = DCACHE_ALIGN(prev_end - offset) + offset;
+				if (addr < prev_end)	/* handle wraparound */
+					return -ENOMEM;
+				/* If vma already violates gap, forget it */
+				if (vma && addr > vma->vm_start)
+					addr = vma->vm_start;
+			}
+		}
 		/* At this point:  (!vma || addr < vma->vm_end). */
 		if (TASK_SIZE - len < addr)
 			return -ENOMEM;
-		if (!vma || addr + len <= vma->vm_start)
+		if (!vma || addr + len <= vm_start_gap(vma))
 			return addr;
-		addr = DCACHE_ALIGN(vma->vm_end - offset) + offset;
-		if (addr < vma->vm_end) /* handle wraparound */
-			return -ENOMEM;
 	}
 }
 
diff -purN 302s/arch/powerpc/mm/slice.c 302h/arch/powerpc/mm/slice.c
--- 302s/arch/powerpc/mm/slice.c	2012-01-04 15:55:44.000000000 -0800
+++ 302h/arch/powerpc/mm/slice.c	2017-06-23 21:36:04.038822093 -0700
@@ -98,7 +98,7 @@ static int slice_area_is_free(struct mm_
 	if ((mm->task_size - len) < addr)
 		return 0;
 	vma = find_vma(mm, addr);
-	return (!vma || (addr + len) <= vma->vm_start);
+	return (!vma || (addr + len) <= vm_start_gap(vma));
 }
 
 static int slice_low_has_vma(struct mm_struct *mm, unsigned long slice)
@@ -227,7 +227,7 @@ static unsigned long slice_find_area_bot
 					      int psize, int use_cache)
 {
 	struct vm_area_struct *vma;
-	unsigned long start_addr, addr;
+	unsigned long start_addr, addr, vm_start;
 	struct slice_mask mask;
 	int pshift = max_t(int, mmu_psize_defs[psize].shift, PAGE_SHIFT);
 
@@ -256,7 +256,9 @@ full_search:
 				addr = _ALIGN_UP(addr + 1,  1ul << SLICE_HIGH_SHIFT);
 			continue;
 		}
-		if (!vma || addr + len <= vma->vm_start) {
+		if (vma)
+			vm_start = vm_start_gap(vma);
+		if (!vma || addr + len <= vm_start) {
 			/*
 			 * Remember the place where we stopped the search:
 			 */
@@ -264,8 +266,8 @@ full_search:
 				mm->free_area_cache = addr + len;
 			return addr;
 		}
-		if (use_cache && (addr + mm->cached_hole_size) < vma->vm_start)
-		        mm->cached_hole_size = vma->vm_start - addr;
+		if (use_cache && (addr + mm->cached_hole_size) < vm_start)
+			mm->cached_hole_size = vm_start - addr;
 		addr = vma->vm_end;
 	}
 
@@ -284,7 +286,7 @@ static unsigned long slice_find_area_top
 					     int psize, int use_cache)
 {
 	struct vm_area_struct *vma;
-	unsigned long addr;
+	unsigned long addr, vm_start;
 	struct slice_mask mask;
 	int pshift = max_t(int, mmu_psize_defs[psize].shift, PAGE_SHIFT);
 
@@ -336,7 +338,9 @@ static unsigned long slice_find_area_top
 		 * return with success:
 		 */
 		vma = find_vma(mm, addr);
-		if (!vma || (addr + len) <= vma->vm_start) {
+		if (vma)
+			vm_start = vm_start_gap(vma);
+		if (!vma || (addr + len) <= vm_start) {
 			/* remember the address as a hint for next time */
 			if (use_cache)
 				mm->free_area_cache = addr;
@@ -344,11 +348,11 @@ static unsigned long slice_find_area_top
 		}
 
 		/* remember the largest hole we saw so far */
-		if (use_cache && (addr + mm->cached_hole_size) < vma->vm_start)
-		        mm->cached_hole_size = vma->vm_start - addr;
+		if (use_cache && (addr + mm->cached_hole_size) < vm_start)
+			mm->cached_hole_size = vm_start - addr;
 
 		/* try just below the current vma->vm_start */
-		addr = vma->vm_start;
+		addr = vm_start;
 	}
 
 	/*
diff -purN 302s/arch/sh/mm/mmap.c 302h/arch/sh/mm/mmap.c
--- 302s/arch/sh/mm/mmap.c	2010-02-24 10:52:17.000000000 -0800
+++ 302h/arch/sh/mm/mmap.c	2017-06-23 21:36:50.758384088 -0700
@@ -47,7 +47,7 @@ unsigned long arch_get_unmapped_area(str
 {
 	struct mm_struct *mm = current->mm;
 	struct vm_area_struct *vma;
-	unsigned long start_addr;
+	unsigned long start_addr, vm_start;
 	int do_colour_align;
 
 	if (flags & MAP_FIXED) {
@@ -75,7 +75,7 @@ unsigned long arch_get_unmapped_area(str
 
 		vma = find_vma(mm, addr);
 		if (TASK_SIZE - len >= addr &&
-		    (!vma || addr + len <= vma->vm_start))
+		    (!vma || addr + len <= vm_start_gap(vma)))
 			return addr;
 	}
 
@@ -106,15 +106,17 @@ full_search:
 			}
 			return -ENOMEM;
 		}
-		if (likely(!vma || addr + len <= vma->vm_start)) {
+		if (vma)
+			vm_start = vm_start_gap(vma);
+		if (likely(!vma || addr + len <= vm_start)) {
 			/*
 			 * Remember the place where we stopped the search:
 			 */
 			mm->free_area_cache = addr + len;
 			return addr;
 		}
-		if (addr + mm->cached_hole_size < vma->vm_start)
-		        mm->cached_hole_size = vma->vm_start - addr;
+		if (addr + mm->cached_hole_size < vm_start)
+			mm->cached_hole_size = vm_start - addr;
 
 		addr = vma->vm_end;
 		if (do_colour_align)
@@ -130,6 +132,7 @@ arch_get_unmapped_area_topdown(struct fi
 	struct vm_area_struct *vma;
 	struct mm_struct *mm = current->mm;
 	unsigned long addr = addr0;
+	unsigned long vm_start;
 	int do_colour_align;
 
 	if (flags & MAP_FIXED) {
@@ -158,7 +161,7 @@ arch_get_unmapped_area_topdown(struct fi
 
 		vma = find_vma(mm, addr);
 		if (TASK_SIZE - len >= addr &&
-		    (!vma || addr + len <= vma->vm_start))
+		    (!vma || addr + len <= vm_start_gap(vma)))
 			return addr;
 	}
 
@@ -179,7 +182,7 @@ arch_get_unmapped_area_topdown(struct fi
 	/* make sure it can fit in the remaining address space */
 	if (likely(addr > len)) {
 		vma = find_vma(mm, addr-len);
-		if (!vma || addr <= vma->vm_start) {
+		if (!vma || addr <= vm_start_gap(vma)) {
 			/* remember the address as a hint for next time */
 			return (mm->free_area_cache = addr-len);
 		}
@@ -199,20 +202,22 @@ arch_get_unmapped_area_topdown(struct fi
 		 * return with success:
 		 */
 		vma = find_vma(mm, addr);
-		if (likely(!vma || addr+len <= vma->vm_start)) {
+		if (vma)
+			vm_start = vm_start_gap(vma);
+		if (likely(!vma || addr + len <= vm_start)) {
 			/* remember the address as a hint for next time */
 			return (mm->free_area_cache = addr);
 		}
 
 		/* remember the largest hole we saw so far */
-		if (addr + mm->cached_hole_size < vma->vm_start)
-		        mm->cached_hole_size = vma->vm_start - addr;
+		if (addr + mm->cached_hole_size < vm_start)
+			mm->cached_hole_size = vm_start - addr;
 
 		/* try just below the current vma->vm_start */
-		addr = vma->vm_start-len;
+		addr = vm_start-len;
 		if (do_colour_align)
 			addr = COLOUR_ALIGN_DOWN(addr, pgoff);
-	} while (likely(len < vma->vm_start));
+	} while (likely(len < vm_start));
 
 bottomup:
 	/*
diff -purN 302s/arch/sparc/kernel/sys_sparc_32.c 302h/arch/sparc/kernel/sys_sparc_32.c
--- 302s/arch/sparc/kernel/sys_sparc_32.c	2011-01-04 16:50:19.000000000 -0800
+++ 302h/arch/sparc/kernel/sys_sparc_32.c	2017-06-22 19:35:28.166491263 -0700
@@ -71,7 +71,7 @@ unsigned long arch_get_unmapped_area(str
 		}
 		if (TASK_SIZE - PAGE_SIZE - len < addr)
 			return -ENOMEM;
-		if (!vmm || addr + len <= vmm->vm_start)
+		if (!vmm || addr + len <= vm_start_gap(vmm))
 			return addr;
 		addr = vmm->vm_end;
 		if (flags & MAP_SHARED)
diff -purN 302s/arch/sparc/kernel/sys_sparc_64.c 302h/arch/sparc/kernel/sys_sparc_64.c
--- 302s/arch/sparc/kernel/sys_sparc_64.c	2017-06-20 16:22:15.661318622 -0700
+++ 302h/arch/sparc/kernel/sys_sparc_64.c	2017-06-23 21:38:31.169442960 -0700
@@ -117,7 +117,7 @@ unsigned long arch_get_unmapped_area(str
 	struct mm_struct *mm = current->mm;
 	struct vm_area_struct * vma;
 	unsigned long task_size = TASK_SIZE;
-	unsigned long start_addr;
+	unsigned long start_addr, vm_start;
 	int do_color_align;
 
 	if (flags & MAP_FIXED) {
@@ -147,7 +147,7 @@ unsigned long arch_get_unmapped_area(str
 
 		vma = find_vma(mm, addr);
 		if (task_size - len >= addr &&
-		    (!vma || addr + len <= vma->vm_start))
+		    (!vma || addr + len <= vm_start_gap(vma)))
 			return addr;
 	}
 
@@ -181,15 +181,17 @@ full_search:
 			}
 			return -ENOMEM;
 		}
-		if (likely(!vma || addr + len <= vma->vm_start)) {
+		if (vma)
+			vm_start = vm_start_gap(vma);
+		if (likely(!vma || addr + len <= vm_start)) {
 			/*
 			 * Remember the place where we stopped the search:
 			 */
 			mm->free_area_cache = addr + len;
 			return addr;
 		}
-		if (addr + mm->cached_hole_size < vma->vm_start)
-		        mm->cached_hole_size = vma->vm_start - addr;
+		if (addr + mm->cached_hole_size < vm_start)
+			mm->cached_hole_size = vm_start - addr;
 
 		addr = vma->vm_end;
 		if (do_color_align)
@@ -237,7 +239,7 @@ arch_get_unmapped_area_topdown(struct fi
 
 		vma = find_vma(mm, addr);
 		if (task_size - len >= addr &&
-		    (!vma || addr + len <= vma->vm_start))
+		    (!vma || addr + len <= vm_start_gap(vma)))
 			return addr;
 	}
 
diff -purN 302s/arch/sparc/mm/hugetlbpage.c 302h/arch/sparc/mm/hugetlbpage.c
--- 302s/arch/sparc/mm/hugetlbpage.c	2012-01-04 15:55:44.000000000 -0800
+++ 302h/arch/sparc/mm/hugetlbpage.c	2017-06-23 21:39:56.800640620 -0700
@@ -33,7 +33,7 @@ static unsigned long hugetlb_get_unmappe
 	struct mm_struct *mm = current->mm;
 	struct vm_area_struct * vma;
 	unsigned long task_size = TASK_SIZE;
-	unsigned long start_addr;
+	unsigned long start_addr, vm_start;
 
 	if (test_thread_flag(TIF_32BIT))
 		task_size = STACK_TOP32;
@@ -67,15 +67,17 @@ full_search:
 			}
 			return -ENOMEM;
 		}
-		if (likely(!vma || addr + len <= vma->vm_start)) {
+		if (vma)
+			vm_start = vm_start_gap(vma);
+		if (likely(!vma || addr + len <= vm_start)) {
 			/*
 			 * Remember the place where we stopped the search:
 			 */
 			mm->free_area_cache = addr + len;
 			return addr;
 		}
-		if (addr + mm->cached_hole_size < vma->vm_start)
-		        mm->cached_hole_size = vma->vm_start - addr;
+		if (addr + mm->cached_hole_size < vm_start)
+			mm->cached_hole_size = vm_start - addr;
 
 		addr = ALIGN(vma->vm_end, HPAGE_SIZE);
 	}
@@ -90,6 +92,7 @@ hugetlb_get_unmapped_area_topdown(struct
 	struct vm_area_struct *vma;
 	struct mm_struct *mm = current->mm;
 	unsigned long addr = addr0;
+	unsigned long vm_start;
 
 	/* This should only ever run for 32-bit processes.  */
 	BUG_ON(!test_thread_flag(TIF_32BIT));
@@ -106,7 +109,7 @@ hugetlb_get_unmapped_area_topdown(struct
 	/* make sure it can fit in the remaining address space */
 	if (likely(addr > len)) {
 		vma = find_vma(mm, addr-len);
-		if (!vma || addr <= vma->vm_start) {
+		if (!vma || addr <= vm_start_gap(vma)) {
 			/* remember the address as a hint for next time */
 			return (mm->free_area_cache = addr-len);
 		}
@@ -124,18 +127,20 @@ hugetlb_get_unmapped_area_topdown(struct
 		 * return with success:
 		 */
 		vma = find_vma(mm, addr);
-		if (likely(!vma || addr+len <= vma->vm_start)) {
+		if (vma)
+			vm_start = vm_start_gap(vma);
+		if (likely(!vma || addr + len <= vm_start)) {
 			/* remember the address as a hint for next time */
 			return (mm->free_area_cache = addr);
 		}
 
  		/* remember the largest hole we saw so far */
- 		if (addr + mm->cached_hole_size < vma->vm_start)
- 		        mm->cached_hole_size = vma->vm_start - addr;
+		if (addr + mm->cached_hole_size < vm_start)
+			mm->cached_hole_size = vm_start - addr;
 
 		/* try just below the current vma->vm_start */
-		addr = (vma->vm_start-len) & HPAGE_MASK;
-	} while (likely(len < vma->vm_start));
+		addr = (vm_start - len) & HPAGE_MASK;
+	} while (likely(len < vm_start));
 
 bottomup:
 	/*
@@ -182,7 +187,7 @@ hugetlb_get_unmapped_area(struct file *f
 		addr = ALIGN(addr, HPAGE_SIZE);
 		vma = find_vma(mm, addr);
 		if (task_size - len >= addr &&
-		    (!vma || addr + len <= vma->vm_start))
+		    (!vma || addr + len <= vm_start_gap(vma)))
 			return addr;
 	}
 	if (mm->get_unmapped_area == arch_get_unmapped_area)
diff -purN 302s/arch/tile/mm/hugetlbpage.c 302h/arch/tile/mm/hugetlbpage.c
--- 302s/arch/tile/mm/hugetlbpage.c	2011-05-18 21:06:34.000000000 -0700
+++ 302h/arch/tile/mm/hugetlbpage.c	2017-06-22 20:35:23.725762639 -0700
@@ -159,7 +159,7 @@ static unsigned long hugetlb_get_unmappe
 	struct hstate *h = hstate_file(file);
 	struct mm_struct *mm = current->mm;
 	struct vm_area_struct *vma;
-	unsigned long start_addr;
+	unsigned long start_addr, vm_start;
 
 	if (len > mm->cached_hole_size) {
 		start_addr = mm->free_area_cache;
@@ -185,12 +185,14 @@ full_search:
 			}
 			return -ENOMEM;
 		}
-		if (!vma || addr + len <= vma->vm_start) {
+		if (vma)
+			vm_start = vm_start_gap(vma);
+		if (!vma || addr + len <= vm_start) {
 			mm->free_area_cache = addr + len;
 			return addr;
 		}
-		if (addr + mm->cached_hole_size < vma->vm_start)
-			mm->cached_hole_size = vma->vm_start - addr;
+		if (addr + mm->cached_hole_size < vm_start)
+			mm->cached_hole_size = vm_start - addr;
 		addr = ALIGN(vma->vm_end, huge_page_size(h));
 	}
 }
@@ -204,6 +206,7 @@ static unsigned long hugetlb_get_unmappe
 	struct vm_area_struct *vma, *prev_vma;
 	unsigned long base = mm->mmap_base, addr = addr0;
 	unsigned long largest_hole = mm->cached_hole_size;
+	unsigned long vm_start;
 	int first_time = 1;
 
 	/* don't allow allocations above current base */
@@ -234,9 +237,10 @@ try_again:
 
 		/*
 		 * new region fits between prev_vma->vm_end and
-		 * vma->vm_start, use it:
+		 * vm_start, use it:
 		 */
-		if (addr + len <= vma->vm_start &&
+		vm_start = vm_start_gap(vma);
+		if (addr + len <= vm_start &&
 			    (!prev_vma || (addr >= prev_vma->vm_end))) {
 			/* remember the address as a hint for next time */
 			mm->cached_hole_size = largest_hole;
@@ -251,13 +255,13 @@ try_again:
 		}
 
 		/* remember the largest hole we saw so far */
-		if (addr + largest_hole < vma->vm_start)
-			largest_hole = vma->vm_start - addr;
+		if (addr + largest_hole < vm_start)
+			largest_hole = vm_start - addr;
 
 		/* try just below the current vma->vm_start */
-		addr = (vma->vm_start - len) & huge_page_mask(h);
+		addr = (vm_start - len) & huge_page_mask(h);
 
-	} while (len <= vma->vm_start);
+	} while (len <= vm_start);
 
 fail:
 	/*
@@ -312,7 +316,7 @@ unsigned long hugetlb_get_unmapped_area(
 		addr = ALIGN(addr, huge_page_size(h));
 		vma = find_vma(mm, addr);
 		if (TASK_SIZE - len >= addr &&
-		    (!vma || addr + len <= vma->vm_start))
+		    (!vma || addr + len <= vm_start_gap(vma)))
 			return addr;
 	}
 	if (current->mm->get_unmapped_area == arch_get_unmapped_area)
diff -purN 302s/arch/x86/kernel/sys_x86_64.c 302h/arch/x86/kernel/sys_x86_64.c
--- 302s/arch/x86/kernel/sys_x86_64.c	2017-06-20 16:22:15.749317803 -0700
+++ 302h/arch/x86/kernel/sys_x86_64.c	2017-06-22 20:36:04.897384626 -0700
@@ -126,7 +126,7 @@ arch_get_unmapped_area(struct file *filp
 {
 	struct mm_struct *mm = current->mm;
 	struct vm_area_struct *vma;
-	unsigned long start_addr;
+	unsigned long start_addr, vm_start;
 	unsigned long begin, end;
 
 	if (flags & MAP_FIXED)
@@ -141,7 +141,7 @@ arch_get_unmapped_area(struct file *filp
 		addr = PAGE_ALIGN(addr);
 		vma = find_vma(mm, addr);
 		if (end - len >= addr &&
-		    (!vma || addr + len <= vma->vm_start))
+		    (!vma || addr + len <= vm_start_gap(vma)))
 			return addr;
 	}
 	if (((flags & MAP_32BIT) || test_thread_flag(TIF_IA32))
@@ -172,15 +172,17 @@ full_search:
 			}
 			return -ENOMEM;
 		}
-		if (!vma || addr + len <= vma->vm_start) {
+		if (vma)
+			vm_start = vm_start_gap(vma);
+		if (!vma || addr + len <= vm_start) {
 			/*
 			 * Remember the place where we stopped the search:
 			 */
 			mm->free_area_cache = addr + len;
 			return addr;
 		}
-		if (addr + mm->cached_hole_size < vma->vm_start)
-			mm->cached_hole_size = vma->vm_start - addr;
+		if (addr + mm->cached_hole_size < vm_start)
+			mm->cached_hole_size = vm_start - addr;
 
 		addr = vma->vm_end;
 		addr = align_addr(addr, filp, 0);
@@ -196,6 +198,7 @@ arch_get_unmapped_area_topdown(struct fi
 	struct vm_area_struct *vma;
 	struct mm_struct *mm = current->mm;
 	unsigned long addr = addr0;
+	unsigned long vm_start;
 
 	/* requested length too big for entire address space */
 	if (len > TASK_SIZE)
@@ -213,7 +216,7 @@ arch_get_unmapped_area_topdown(struct fi
 		addr = PAGE_ALIGN(addr);
 		vma = find_vma(mm, addr);
 		if (TASK_SIZE - len >= addr &&
-				(!vma || addr + len <= vma->vm_start))
+				(!vma || addr + len <= vm_start_gap(vma)))
 			return addr;
 	}
 
@@ -232,7 +235,7 @@ arch_get_unmapped_area_topdown(struct fi
 						    ALIGN_TOPDOWN);
 
 		vma = find_vma(mm, tmp_addr);
-		if (!vma || tmp_addr + len <= vma->vm_start)
+		if (!vma || tmp_addr + len <= vm_start_gap(vma))
 			/* remember the address as a hint for next time */
 			return mm->free_area_cache = tmp_addr;
 	}
@@ -251,17 +254,19 @@ arch_get_unmapped_area_topdown(struct fi
 		 * return with success:
 		 */
 		vma = find_vma(mm, addr);
-		if (!vma || addr+len <= vma->vm_start)
+		if (vma)
+			vm_start = vm_start_gap(vma);
+		if (!vma || addr + len <= vm_start)
 			/* remember the address as a hint for next time */
 			return mm->free_area_cache = addr;
 
 		/* remember the largest hole we saw so far */
-		if (addr + mm->cached_hole_size < vma->vm_start)
-			mm->cached_hole_size = vma->vm_start - addr;
+		if (addr + mm->cached_hole_size < vm_start)
+			mm->cached_hole_size = vm_start - addr;
 
 		/* try just below the current vma->vm_start */
-		addr = vma->vm_start-len;
-	} while (len < vma->vm_start);
+		addr = vm_start - len;
+	} while (len < vm_start);
 
 bottomup:
 	/*
diff -purN 302s/arch/x86/mm/hugetlbpage.c 302h/arch/x86/mm/hugetlbpage.c
--- 302s/arch/x86/mm/hugetlbpage.c	2017-06-20 16:22:15.773317580 -0700
+++ 302h/arch/x86/mm/hugetlbpage.c	2017-06-23 21:40:52.016123391 -0700
@@ -277,7 +277,7 @@ static unsigned long hugetlb_get_unmappe
 	struct hstate *h = hstate_file(file);
 	struct mm_struct *mm = current->mm;
 	struct vm_area_struct *vma;
-	unsigned long start_addr;
+	unsigned long start_addr, vm_start;
 
 	if (len > mm->cached_hole_size) {
 	        start_addr = mm->free_area_cache;
@@ -303,12 +303,14 @@ full_search:
 			}
 			return -ENOMEM;
 		}
-		if (!vma || addr + len <= vma->vm_start) {
+		if (vma)
+			vm_start = vm_start_gap(vma);
+		if (!vma || addr + len <= vm_start) {
 			mm->free_area_cache = addr + len;
 			return addr;
 		}
-		if (addr + mm->cached_hole_size < vma->vm_start)
-		        mm->cached_hole_size = vma->vm_start - addr;
+		if (addr + mm->cached_hole_size < vm_start)
+			mm->cached_hole_size = vm_start - addr;
 		addr = ALIGN(vma->vm_end, huge_page_size(h));
 	}
 }
@@ -322,6 +324,7 @@ static unsigned long hugetlb_get_unmappe
 	struct vm_area_struct *vma, *prev_vma;
 	unsigned long base = mm->mmap_base, addr = addr0;
 	unsigned long largest_hole = mm->cached_hole_size;
+	unsigned long vm_start;
 	int first_time = 1;
 
 	/* don't allow allocations above current base */
@@ -351,7 +354,8 @@ try_again:
 		 * new region fits between prev_vma->vm_end and
 		 * vma->vm_start, use it:
 		 */
-		if (addr + len <= vma->vm_start &&
+		vm_start = vm_start_gap(vma);
+		if (addr + len <= vm_start &&
 		            (!prev_vma || (addr >= prev_vma->vm_end))) {
 			/* remember the address as a hint for next time */
 		        mm->cached_hole_size = largest_hole;
@@ -365,12 +369,12 @@ try_again:
 		}
 
 		/* remember the largest hole we saw so far */
-		if (addr + largest_hole < vma->vm_start)
-		        largest_hole = vma->vm_start - addr;
+		if (addr + largest_hole < vm_start)
+			largest_hole = vm_start - addr;
 
 		/* try just below the current vma->vm_start */
-		addr = (vma->vm_start - len) & huge_page_mask(h);
-	} while (len <= vma->vm_start);
+		addr = (vm_start - len) & huge_page_mask(h);
+	} while (len <= vm_start);
 
 fail:
 	/*
@@ -426,7 +430,7 @@ hugetlb_get_unmapped_area(struct file *f
 		addr = ALIGN(addr, huge_page_size(h));
 		vma = find_vma(mm, addr);
 		if (TASK_SIZE - len >= addr &&
-		    (!vma || addr + len <= vma->vm_start))
+		    (!vma || addr + len <= vm_start_gap(vma)))
 			return addr;
 	}
 	if (mm->get_unmapped_area == arch_get_unmapped_area)
diff -purN 302s/Documentation/kernel-parameters.txt 302h/Documentation/kernel-parameters.txt
--- 302s/Documentation/kernel-parameters.txt	2017-06-20 16:22:15.389321153 -0700
+++ 302h/Documentation/kernel-parameters.txt	2017-06-21 20:07:38.174763661 -0700
@@ -2457,6 +2457,13 @@ bytes respectively. Such letter suffixes
 	spia_pedr=
 	spia_peddr=
 
+	stack_guard_gap=	[MM]
+			override the default stack gap protection. The value
+			is in page units and it defines how many pages prior
+			to (for stacks growing down) resp. after (for stacks
+			growing up) the main stack are reserved for no other
+			mapping. Default value is 256 pages.
+
 	stacktrace	[FTRACE]
 			Enabled the stack tracer on boot up.
 
diff -purN 302s/fs/hugetlbfs/inode.c 302h/fs/hugetlbfs/inode.c
--- 302s/fs/hugetlbfs/inode.c	2017-06-20 16:22:17.277303587 -0700
+++ 302h/fs/hugetlbfs/inode.c	2017-06-21 20:07:38.174763661 -0700
@@ -150,7 +150,7 @@ hugetlb_get_unmapped_area(struct file *f
 		addr = ALIGN(addr, huge_page_size(h));
 		vma = find_vma(mm, addr);
 		if (TASK_SIZE - len >= addr &&
-		    (!vma || addr + len <= vma->vm_start))
+		    (!vma || addr + len <= vm_start_gap(vma)))
 			return addr;
 	}
 
diff -purN 302s/fs/proc/task_mmu.c 302h/fs/proc/task_mmu.c
--- 302s/fs/proc/task_mmu.c	2017-06-20 16:22:17.401302434 -0700
+++ 302h/fs/proc/task_mmu.c	2017-06-21 20:07:38.174763661 -0700
@@ -230,11 +230,7 @@ static void show_map_vma(struct seq_file
 
 	/* We don't show the stack guard page in /proc/maps */
 	start = vma->vm_start;
-	if (stack_guard_page_start(vma, start))
-		start += PAGE_SIZE;
 	end = vma->vm_end;
-	if (stack_guard_page_end(vma, end))
-		end -= PAGE_SIZE;
 
 	seq_printf(m, "%08lx-%08lx %c%c%c%c %08llx %02x:%02x %lu %n",
 			start,
diff -purN 302s/include/linux/mm.h 302h/include/linux/mm.h
--- 302s/include/linux/mm.h	2017-06-20 16:22:17.509301429 -0700
+++ 302h/include/linux/mm.h	2017-06-22 17:47:33.388923303 -0700
@@ -1015,34 +1015,6 @@ int set_page_dirty(struct page *page);
 int set_page_dirty_lock(struct page *page);
 int clear_page_dirty_for_io(struct page *page);
 
-/* Is the vma a continuation of the stack vma above it? */
-static inline int vma_growsdown(struct vm_area_struct *vma, unsigned long addr)
-{
-	return vma && (vma->vm_end == addr) && (vma->vm_flags & VM_GROWSDOWN);
-}
-
-static inline int stack_guard_page_start(struct vm_area_struct *vma,
-					     unsigned long addr)
-{
-	return (vma->vm_flags & VM_GROWSDOWN) &&
-		(vma->vm_start == addr) &&
-		!vma_growsdown(vma->vm_prev, addr);
-}
-
-/* Is the vma a continuation of the stack vma below it? */
-static inline int vma_growsup(struct vm_area_struct *vma, unsigned long addr)
-{
-	return vma && (vma->vm_start == addr) && (vma->vm_flags & VM_GROWSUP);
-}
-
-static inline int stack_guard_page_end(struct vm_area_struct *vma,
-					   unsigned long addr)
-{
-	return (vma->vm_flags & VM_GROWSUP) &&
-		(vma->vm_end == addr) &&
-		!vma_growsup(vma->vm_next, addr);
-}
-
 extern unsigned long move_page_tables(struct vm_area_struct *vma,
 		unsigned long old_addr, struct vm_area_struct *new_vma,
 		unsigned long new_addr, unsigned long len);
@@ -1462,6 +1434,7 @@ unsigned long ra_submit(struct file_ra_s
 			struct address_space *mapping,
 			struct file *filp);
 
+extern unsigned long stack_guard_gap;
 /* Generic expand stack which grows the stack according to GROWS{UP,DOWN} */
 extern int expand_stack(struct vm_area_struct *vma, unsigned long address);
 
@@ -1490,6 +1463,30 @@ static inline struct vm_area_struct * fi
 	return vma;
 }
 
+static inline unsigned long vm_start_gap(struct vm_area_struct *vma)
+{
+	unsigned long vm_start = vma->vm_start;
+
+	if (vma->vm_flags & VM_GROWSDOWN) {
+		vm_start -= stack_guard_gap;
+		if (vm_start > vma->vm_start)
+			vm_start = 0;
+	}
+	return vm_start;
+}
+
+static inline unsigned long vm_end_gap(struct vm_area_struct *vma)
+{
+	unsigned long vm_end = vma->vm_end;
+
+	if (vma->vm_flags & VM_GROWSUP) {
+		vm_end += stack_guard_gap;
+		if (vm_end < vma->vm_end)
+			vm_end = -PAGE_SIZE;
+	}
+	return vm_end;
+}
+
 static inline unsigned long vma_pages(struct vm_area_struct *vma)
 {
 	return (vma->vm_end - vma->vm_start) >> PAGE_SHIFT;
diff -purN 302s/mm/memory.c 302h/mm/memory.c
--- 302s/mm/memory.c	2017-06-20 16:22:17.725299419 -0700
+++ 302h/mm/memory.c	2017-06-21 20:07:38.178763623 -0700
@@ -1605,12 +1605,6 @@ no_page_table:
 	return page;
 }
 
-static inline int stack_guard_page(struct vm_area_struct *vma, unsigned long addr)
-{
-	return stack_guard_page_start(vma, addr) ||
-	       stack_guard_page_end(vma, addr+PAGE_SIZE);
-}
-
 /**
  * __get_user_pages() - pin user pages in memory
  * @tsk:	task_struct of target task
@@ -1761,11 +1755,6 @@ int __get_user_pages(struct task_struct
 				int ret;
 				unsigned int fault_flags = 0;
 
-				/* For mlock, just skip the stack guard page. */
-				if (foll_flags & FOLL_MLOCK) {
-					if (stack_guard_page(vma, start))
-						goto next_page;
-				}
 				if (foll_flags & FOLL_WRITE)
 					fault_flags |= FAULT_FLAG_WRITE;
 				if (nonblocking)
@@ -3122,40 +3111,6 @@ out_release:
 }
 
 /*
- * This is like a special single-page "expand_{down|up}wards()",
- * except we must first make sure that 'address{-|+}PAGE_SIZE'
- * doesn't hit another vma.
- */
-static inline int check_stack_guard_page(struct vm_area_struct *vma, unsigned long address)
-{
-	address &= PAGE_MASK;
-	if ((vma->vm_flags & VM_GROWSDOWN) && address == vma->vm_start) {
-		struct vm_area_struct *prev = vma->vm_prev;
-
-		/*
-		 * Is there a mapping abutting this one below?
-		 *
-		 * That's only ok if it's the same stack mapping
-		 * that has gotten split..
-		 */
-		if (prev && prev->vm_end == address)
-			return prev->vm_flags & VM_GROWSDOWN ? 0 : -ENOMEM;
-
-		return expand_downwards(vma, address - PAGE_SIZE);
-	}
-	if ((vma->vm_flags & VM_GROWSUP) && address + PAGE_SIZE == vma->vm_end) {
-		struct vm_area_struct *next = vma->vm_next;
-
-		/* As VM_GROWSDOWN but s/below/above/ */
-		if (next && next->vm_start == address + PAGE_SIZE)
-			return next->vm_flags & VM_GROWSUP ? 0 : -ENOMEM;
-
-		return expand_upwards(vma, address + PAGE_SIZE);
-	}
-	return 0;
-}
-
-/*
  * We enter with non-exclusive mmap_sem (to exclude vma changes,
  * but allow concurrent faults), and pte mapped but not yet locked.
  * We return with mmap_sem still held, but pte unmapped and unlocked.
@@ -3174,10 +3129,6 @@ static int do_anonymous_page(struct mm_s
 	if (vma->vm_flags & VM_SHARED)
 		return VM_FAULT_SIGBUS;
 
-	/* Check if we need to add a guard page to the stack */
-	if (check_stack_guard_page(vma, address) < 0)
-		return VM_FAULT_SIGSEGV;
-
 	/* Use the zero-page for reads */
 	if (!(flags & FAULT_FLAG_WRITE)) {
 		entry = pte_mkspecial(pfn_pte(my_zero_pfn(address),
diff -purN 302s/mm/mmap.c 302h/mm/mmap.c
--- 302s/mm/mmap.c	2017-06-20 16:22:17.733299345 -0700
+++ 302h/mm/mmap.c	2017-06-23 21:42:54.430977017 -0700
@@ -245,6 +245,7 @@ SYSCALL_DEFINE1(brk, unsigned long, brk)
 	unsigned long rlim, retval;
 	unsigned long newbrk, oldbrk;
 	struct mm_struct *mm = current->mm;
+	struct vm_area_struct *next;
 	unsigned long min_brk;
 
 	down_write(&mm->mmap_sem);
@@ -289,7 +290,8 @@ SYSCALL_DEFINE1(brk, unsigned long, brk)
 	}
 
 	/* Check against existing mmap mappings. */
-	if (find_vma_intersection(mm, oldbrk, newbrk+PAGE_SIZE))
+	next = find_vma(mm, oldbrk);
+	if (next && newbrk + PAGE_SIZE > vm_start_gap(next))
 		goto out;
 
 	/* Ok, looks good - let it rip. */
@@ -1368,8 +1370,8 @@ arch_get_unmapped_area(struct file *filp
 		unsigned long len, unsigned long pgoff, unsigned long flags)
 {
 	struct mm_struct *mm = current->mm;
-	struct vm_area_struct *vma;
-	unsigned long start_addr;
+	struct vm_area_struct *vma, *prev;
+	unsigned long start_addr, vm_start, prev_end;
 
 	if (len > TASK_SIZE - mmap_min_addr)
 		return -ENOMEM;
@@ -1379,9 +1381,10 @@ arch_get_unmapped_area(struct file *filp
 
 	if (addr) {
 		addr = PAGE_ALIGN(addr);
-		vma = find_vma(mm, addr);
+		vma = find_vma_prev(mm, addr, &prev);
 		if (TASK_SIZE - len >= addr && addr >= mmap_min_addr &&
-		    (!vma || addr + len <= vma->vm_start))
+		    (!vma || addr + len <= vm_start_gap(vma)) &&
+		    (!prev || addr >= vm_end_gap(prev)))
 			return addr;
 	}
 	if (len > mm->cached_hole_size) {
@@ -1392,7 +1395,17 @@ arch_get_unmapped_area(struct file *filp
 	}
 
 full_search:
-	for (vma = find_vma(mm, addr); ; vma = vma->vm_next) {
+	for (vma = find_vma_prev(mm, addr, &prev); ; prev = vma,
+						vma = vma->vm_next) {
+		if (prev) {
+			prev_end = vm_end_gap(prev);
+			if (addr < prev_end) {
+				addr = prev_end;
+				/* If vma already violates gap, forget it */
+				if (vma && addr > vma->vm_start)
+					addr = vma->vm_start;
+			}
+		}
 		/* At this point:  (!vma || addr < vma->vm_end). */
 		if (TASK_SIZE - len < addr) {
 			/*
@@ -1407,16 +1420,16 @@ full_search:
 			}
 			return -ENOMEM;
 		}
-		if (!vma || addr + len <= vma->vm_start) {
+		vm_start = vma ? vm_start_gap(vma) : TASK_SIZE;
+		if (addr + len <= vm_start) {
 			/*
 			 * Remember the place where we stopped the search:
 			 */
 			mm->free_area_cache = addr + len;
 			return addr;
 		}
-		if (addr + mm->cached_hole_size < vma->vm_start)
-		        mm->cached_hole_size = vma->vm_start - addr;
-		addr = vma->vm_end;
+		if (addr + mm->cached_hole_size < vm_start)
+			mm->cached_hole_size = vm_start - addr;
 	}
 }
 #endif	
@@ -1442,9 +1455,10 @@ arch_get_unmapped_area_topdown(struct fi
 			  const unsigned long len, const unsigned long pgoff,
 			  const unsigned long flags)
 {
-	struct vm_area_struct *vma;
+	struct vm_area_struct *vma, *prev;
 	struct mm_struct *mm = current->mm;
 	unsigned long addr = addr0;
+	unsigned long vm_start, prev_end;
 	unsigned long low_limit = max(PAGE_SIZE, mmap_min_addr);
 
 	/* requested length too big for entire address space */
@@ -1457,9 +1471,10 @@ arch_get_unmapped_area_topdown(struct fi
 	/* requesting a specific address */
 	if (addr) {
 		addr = PAGE_ALIGN(addr);
-		vma = find_vma(mm, addr);
+		vma = find_vma_prev(mm, addr, &prev);
 		if (TASK_SIZE - len >= addr && addr >= mmap_min_addr &&
-				(!vma || addr + len <= vma->vm_start))
+				(!vma || addr + len <= vm_start_gap(vma)) &&
+				(!prev || addr >= vm_end_gap(prev)))
 			return addr;
 	}
 
@@ -1474,8 +1489,9 @@ arch_get_unmapped_area_topdown(struct fi
 
 	/* make sure it can fit in the remaining address space */
 	if (addr >= low_limit + len) {
-		vma = find_vma(mm, addr-len);
-		if (!vma || addr <= vma->vm_start)
+		vma = find_vma_prev(mm, addr-len, &prev);
+		if ((!vma || addr <= vm_start_gap(vma)) &&
+		    (!prev || addr-len >= vm_end_gap(prev)))
 			/* remember the address as a hint for next time */
 			return (mm->free_area_cache = addr-len);
 	}
@@ -1491,18 +1507,21 @@ arch_get_unmapped_area_topdown(struct fi
 		 * else if new region fits below vma->vm_start,
 		 * return with success:
 		 */
-		vma = find_vma(mm, addr);
-		if (!vma || addr+len <= vma->vm_start)
+		vma = find_vma_prev(mm, addr, &prev);
+		vm_start = vma ? vm_start_gap(vma) : mm->mmap_base;
+		prev_end = prev ? vm_end_gap(prev) : low_limit;
+
+		if (addr + len <= vm_start && addr >= prev_end)
 			/* remember the address as a hint for next time */
 			return (mm->free_area_cache = addr);
 
  		/* remember the largest hole we saw so far */
- 		if (addr + mm->cached_hole_size < vma->vm_start)
- 		        mm->cached_hole_size = vma->vm_start - addr;
+		if (addr + mm->cached_hole_size < vm_start)
+			mm->cached_hole_size = vm_start - addr;
 
 		/* try just below the current vma->vm_start */
-		addr = vma->vm_start-len;
-	} while (vma->vm_start >= low_limit + len);
+		addr = vm_start - len;
+	} while (vm_start >= low_limit + len);
 
 bottomup:
 	/*
@@ -1647,21 +1666,19 @@ out:
  * update accounting. This is shared with both the
  * grow-up and grow-down cases.
  */
-static int acct_stack_growth(struct vm_area_struct *vma, unsigned long size, unsigned long grow)
+static int acct_stack_growth(struct vm_area_struct *vma,
+			     unsigned long size, unsigned long grow)
 {
 	struct mm_struct *mm = vma->vm_mm;
 	struct rlimit *rlim = current->signal->rlim;
-	unsigned long new_start, actual_size;
+	unsigned long new_start;
 
 	/* address space limit tests */
 	if (!may_expand_vm(mm, grow))
 		return -ENOMEM;
 
 	/* Stack limit test */
-	actual_size = size;
-	if (size && (vma->vm_flags & (VM_GROWSUP | VM_GROWSDOWN)))
-		actual_size -= PAGE_SIZE;
-	if (actual_size > ACCESS_ONCE(rlim[RLIMIT_STACK].rlim_cur))
+	if (size > ACCESS_ONCE(rlim[RLIMIT_STACK].rlim_cur))
 		return -ENOMEM;
 
 	/* mlock limit tests */
@@ -1703,32 +1720,40 @@ static int acct_stack_growth(struct vm_a
  */
 int expand_upwards(struct vm_area_struct *vma, unsigned long address)
 {
-	int error;
+	struct vm_area_struct *next;
+	unsigned long gap_addr;
+	int error = 0;
 
 	if (!(vma->vm_flags & VM_GROWSUP))
 		return -EFAULT;
 
-	/*
-	 * We must make sure the anon_vma is allocated
-	 * so that the anon_vma locking is not a noop.
-	 */
+	/* Guard against wrapping around to address 0. */
+	address &= PAGE_MASK;
+	address += PAGE_SIZE;
+	if (!address)
+		return -ENOMEM;
+
+	/* Enforce stack_guard_gap */
+	gap_addr = address + stack_guard_gap;
+	if (gap_addr < address)
+		return -ENOMEM;
+	next = vma->vm_next;
+	if (next && next->vm_start < gap_addr) {
+		if (!(next->vm_flags & VM_GROWSUP))
+			return -ENOMEM;
+		/* Check that both stack segments have the same anon_vma? */
+	}
+
+	/* We must make sure the anon_vma is allocated. */
 	if (unlikely(anon_vma_prepare(vma)))
 		return -ENOMEM;
-	vma_lock_anon_vma(vma);
 
 	/*
 	 * vma->vm_start/vm_end cannot change under us because the caller
 	 * is required to hold the mmap_sem in read mode.  We need the
 	 * anon_vma lock to serialize against concurrent expand_stacks.
-	 * Also guard against wrapping around to address 0.
 	 */
-	if (address < PAGE_ALIGN(address+4))
-		address = PAGE_ALIGN(address+4);
-	else {
-		vma_unlock_anon_vma(vma);
-		return -ENOMEM;
-	}
-	error = 0;
+	vma_lock_anon_vma(vma);
 
 	/* Somebody else might have raced and expanded it already */
 	if (address > vma->vm_end) {
@@ -1758,27 +1783,36 @@ int expand_upwards(struct vm_area_struct
 int expand_downwards(struct vm_area_struct *vma,
 				   unsigned long address)
 {
+	struct vm_area_struct *prev;
+	unsigned long gap_addr;
 	int error;
 
-	/*
-	 * We must make sure the anon_vma is allocated
-	 * so that the anon_vma locking is not a noop.
-	 */
-	if (unlikely(anon_vma_prepare(vma)))
-		return -ENOMEM;
-
 	address &= PAGE_MASK;
 	error = security_file_mmap(NULL, 0, 0, 0, address, 1);
 	if (error)
 		return error;
 
-	vma_lock_anon_vma(vma);
+	/* Enforce stack_guard_gap */
+	gap_addr = address - stack_guard_gap;
+	if (gap_addr > address)
+		return -ENOMEM;
+	prev = vma->vm_prev;
+	if (prev && prev->vm_end > gap_addr) {
+		if (!(prev->vm_flags & VM_GROWSDOWN))
+			return -ENOMEM;
+		/* Check that both stack segments have the same anon_vma? */
+	}
+
+	/* We must make sure the anon_vma is allocated. */
+	if (unlikely(anon_vma_prepare(vma)))
+		return -ENOMEM;
 
 	/*
 	 * vma->vm_start/vm_end cannot change under us because the caller
 	 * is required to hold the mmap_sem in read mode.  We need the
 	 * anon_vma lock to serialize against concurrent expand_stacks.
 	 */
+	vma_lock_anon_vma(vma);
 
 	/* Somebody else might have raced and expanded it already */
 	if (address < vma->vm_start) {
@@ -1802,6 +1836,22 @@ int expand_downwards(struct vm_area_stru
 	return error;
 }
 
+/* enforced gap between the expanding stack and other mappings. */
+unsigned long stack_guard_gap = 256UL<<PAGE_SHIFT;
+
+static int __init cmdline_parse_stack_guard_gap(char *p)
+{
+	unsigned long val;
+	char *endptr;
+
+	val = simple_strtoul(p, &endptr, 10);
+	if (!*endptr)
+		stack_guard_gap = val << PAGE_SHIFT;
+
+	return 0;
+}
+__setup("stack_guard_gap=", cmdline_parse_stack_guard_gap);
+
 #ifdef CONFIG_STACK_GROWSUP
 int expand_stack(struct vm_area_struct *vma, unsigned long address)
 {

Re: [PATCH] mm: larger stack guard gap, between vmas

[Ben Hutchings]

[-- Attachment #1: Type: text/plain, Size: 2071 bytes --]

On Sat, 2017-06-24 at 02:11 -0700, Hugh Dickins wrote:
> On Thu, 22 Jun 2017, Hugh Dickins wrote:
> > On Thu, 22 Jun 2017, Ben Hutchings wrote:
> > 
> > > Here's my attempt at a backport to 3.2.  This is only tested on
> > > x86_64 and I think I should introduce local variables for
> > > vma_start_gap() in a few places.  I had to cherry-pick commit
> > > 09884964335e "mm: do not grow the stack vma just because of an overrun
> > > on preceding vma" before this one (which was a clean cherry-pick).
> > 
> > Both your speed and your stamina are much better than mine; and your
> > patch belies your Sturgeon's law signature.  I haven't got beyond the
> > architectures yet in my parallel attempt, and you do appear to be
> > doing everything right (but a local variable often welcome, yes).
> > 
> > I'm giving up for the night, will contine tomorrow.
> > The only discrepancy I notice so far is that I have
> > arch/alpha/kernel/osf_sys.c
> > arch/ia64/mm/hugetlbpage.c
> > arch/sparc/kernel/sys_sparc_32.c
> > in my list of changed files, but they're not in yours.
> 
> And here's my attempt at a backport to 3.2.89, at last.
> I know it builds and boots and runs on x86 64 and 32,
> but that's about all that I've tried.
> 
> If you diff against yours (I preferred not to send that diff,
> because of the couple of rejects in yours against 3.2.89),
> you'll find most of the difference is just noise from where
> I used a variable, but you had not yet done so in yours.

Thanks, this is much nicer.

> But there are those three missing files, and there are a few
> places where I have a little "if (prev) {" block at the head of
> the loop after find_vma_prev(): I think those loops start off
> wrongly without that.

I also failed to update prev.

[...]
> So please at least take a look through the diff from yours, I
> think you'll find a few things to bring in, but a lot to ignore.

I think I'll take most of yours, thanks.

Ben.

-- 
Ben Hutchings
Sturgeon's Law: Ninety percent of everything is crap.


[-- Attachment #2: This is a digitally signed message part --]
[-- Type: application/pgp-signature, Size: 833 bytes --]