diff -urN 2.4.10pre11/arch/alpha/mm/fault.c silent-stack-overflow/arch/alpha/mm/fault.c --- 2.4.10pre11/arch/alpha/mm/fault.c Tue Sep 18 02:41:49 2001 +++ silent-stack-overflow/arch/alpha/mm/fault.c Tue Sep 18 10:08:51 2001 @@ -121,7 +121,7 @@ goto good_area; if (!(vma->vm_flags & VM_GROWSDOWN)) goto bad_area; - if (expand_stack(vma, address)) + if (expand_stack(vma, address, NULL)) goto bad_area; /* * Ok, we have a good vm_area for this memory access, so diff -urN 2.4.10pre11/arch/arm/mm/fault-common.c silent-stack-overflow/arch/arm/mm/fault-common.c --- 2.4.10pre11/arch/arm/mm/fault-common.c Thu Aug 16 22:03:23 2001 +++ silent-stack-overflow/arch/arm/mm/fault-common.c Tue Sep 18 10:08:51 2001 @@ -229,7 +229,7 @@ goto survive; check_stack: - if (vma->vm_flags & VM_GROWSDOWN && !expand_stack(vma, addr)) + if (vma->vm_flags & VM_GROWSDOWN && !expand_stack(vma, addr, NULL)) goto good_area; out: return fault; diff -urN 2.4.10pre11/arch/cris/mm/fault.c silent-stack-overflow/arch/cris/mm/fault.c --- 2.4.10pre11/arch/cris/mm/fault.c Sat Aug 11 08:03:54 2001 +++ silent-stack-overflow/arch/cris/mm/fault.c Tue Sep 18 10:08:51 2001 @@ -284,7 +284,7 @@ if (address + PAGE_SIZE < rdusp()) goto bad_area; } - if (expand_stack(vma, address)) + if (expand_stack(vma, address, NULL)) goto bad_area; /* diff -urN 2.4.10pre11/arch/i386/mm/fault.c silent-stack-overflow/arch/i386/mm/fault.c --- 2.4.10pre11/arch/i386/mm/fault.c Tue Sep 18 02:41:57 2001 +++ silent-stack-overflow/arch/i386/mm/fault.c Tue Sep 18 10:08:51 2001 @@ -33,7 +33,7 @@ */ int __verify_write(const void * addr, unsigned long size) { - struct vm_area_struct * vma; + struct vm_area_struct * vma, * prev_vma; unsigned long start = (unsigned long) addr; if (!size) @@ -79,7 +79,8 @@ check_stack: if (!(vma->vm_flags & VM_GROWSDOWN)) goto bad_area; - if (expand_stack(vma, start) == 0) + find_vma_prev(current->mm, start, &prev_vma); + if (expand_stack(vma, start, prev_vma) == 0) goto good_area; bad_area: @@ -152,7 +153,7 @@ { struct task_struct *tsk; struct mm_struct *mm; - struct vm_area_struct * vma; + struct vm_area_struct * vma, * prev_vma; unsigned long address; unsigned long page; unsigned long fixup; @@ -213,7 +214,8 @@ if (address + 32 < regs->esp) goto bad_area; } - if (expand_stack(vma, address)) + find_vma_prev(mm, address, &prev_vma); + if (expand_stack(vma, address, prev_vma)) goto bad_area; /* * Ok, we have a good vm_area for this memory access, so diff -urN 2.4.10pre11/arch/ia64/mm/fault.c silent-stack-overflow/arch/ia64/mm/fault.c --- 2.4.10pre11/arch/ia64/mm/fault.c Tue May 1 19:35:18 2001 +++ silent-stack-overflow/arch/ia64/mm/fault.c Tue Sep 18 10:08:51 2001 @@ -122,7 +122,7 @@ if (rgn_index(address) != rgn_index(vma->vm_start) || rgn_offset(address) >= RGN_MAP_LIMIT) goto bad_area; - if (expand_stack(vma, address)) + if (expand_stack(vma, address, NULL)) goto bad_area; } else { vma = prev_vma; diff -urN 2.4.10pre11/arch/m68k/mm/fault.c silent-stack-overflow/arch/m68k/mm/fault.c --- 2.4.10pre11/arch/m68k/mm/fault.c Sun Apr 1 01:17:08 2001 +++ silent-stack-overflow/arch/m68k/mm/fault.c Tue Sep 18 10:08:51 2001 @@ -120,7 +120,7 @@ if (address + 256 < rdusp()) goto map_err; } - if (expand_stack(vma, address)) + if (expand_stack(vma, address, NULL)) goto map_err; /* diff -urN 2.4.10pre11/arch/mips/mm/fault.c silent-stack-overflow/arch/mips/mm/fault.c --- 2.4.10pre11/arch/mips/mm/fault.c Sat Jul 21 00:04:05 2001 +++ silent-stack-overflow/arch/mips/mm/fault.c Tue Sep 18 10:08:51 2001 @@ -80,7 +80,7 @@ goto good_area; if (!(vma->vm_flags & VM_GROWSDOWN)) goto bad_area; - if (expand_stack(vma, address)) + if (expand_stack(vma, address, NULL)) goto bad_area; /* * Ok, we have a good vm_area for this memory access, so diff -urN 2.4.10pre11/arch/mips64/mm/fault.c silent-stack-overflow/arch/mips64/mm/fault.c --- 2.4.10pre11/arch/mips64/mm/fault.c Tue Sep 18 02:42:13 2001 +++ silent-stack-overflow/arch/mips64/mm/fault.c Tue Sep 18 10:08:51 2001 @@ -132,7 +132,7 @@ goto good_area; if (!(vma->vm_flags & VM_GROWSDOWN)) goto bad_area; - if (expand_stack(vma, address)) + if (expand_stack(vma, address, NULL)) goto bad_area; /* * Ok, we have a good vm_area for this memory access, so diff -urN 2.4.10pre11/arch/ppc/mm/fault.c silent-stack-overflow/arch/ppc/mm/fault.c --- 2.4.10pre11/arch/ppc/mm/fault.c Wed Jul 4 04:03:45 2001 +++ silent-stack-overflow/arch/ppc/mm/fault.c Tue Sep 18 10:08:51 2001 @@ -64,7 +64,7 @@ void do_page_fault(struct pt_regs *regs, unsigned long address, unsigned long error_code) { - struct vm_area_struct * vma; + struct vm_area_struct * vma, * prev_vma; struct mm_struct *mm = current->mm; siginfo_t info; int code = SEGV_MAPERR; @@ -111,7 +111,8 @@ goto good_area; if (!(vma->vm_flags & VM_GROWSDOWN)) goto bad_area; - if (expand_stack(vma, address)) + vma = find_vma_prev(mm, address, &prev_vma); + if (expand_stack(vma, address, prev_vma)) goto bad_area; good_area: diff -urN 2.4.10pre11/arch/s390/mm/fault.c silent-stack-overflow/arch/s390/mm/fault.c --- 2.4.10pre11/arch/s390/mm/fault.c Sat Aug 11 08:03:59 2001 +++ silent-stack-overflow/arch/s390/mm/fault.c Tue Sep 18 10:08:51 2001 @@ -122,7 +122,7 @@ goto good_area; if (!(vma->vm_flags & VM_GROWSDOWN)) goto bad_area; - if (expand_stack(vma, address)) + if (expand_stack(vma, address, NULL)) goto bad_area; /* * Ok, we have a good vm_area for this memory access, so diff -urN 2.4.10pre11/arch/s390x/mm/fault.c silent-stack-overflow/arch/s390x/mm/fault.c --- 2.4.10pre11/arch/s390x/mm/fault.c Sat Aug 11 08:04:00 2001 +++ silent-stack-overflow/arch/s390x/mm/fault.c Tue Sep 18 10:08:51 2001 @@ -152,7 +152,7 @@ goto good_area; if (!(vma->vm_flags & VM_GROWSDOWN)) goto bad_area; - if (expand_stack(vma, address)) + if (expand_stack(vma, address, NULL)) goto bad_area; /* * Ok, we have a good vm_area for this memory access, so diff -urN 2.4.10pre11/arch/sh/mm/fault.c silent-stack-overflow/arch/sh/mm/fault.c --- 2.4.10pre11/arch/sh/mm/fault.c Tue Sep 18 02:42:19 2001 +++ silent-stack-overflow/arch/sh/mm/fault.c Tue Sep 18 10:08:51 2001 @@ -74,7 +74,7 @@ check_stack: if (!(vma->vm_flags & VM_GROWSDOWN)) goto bad_area; - if (expand_stack(vma, start) == 0) + if (expand_stack(vma, start, NULL) == 0) goto good_area; bad_area: @@ -114,7 +114,7 @@ goto good_area; if (!(vma->vm_flags & VM_GROWSDOWN)) goto bad_area; - if (expand_stack(vma, address)) + if (expand_stack(vma, address, NULL)) goto bad_area; /* * Ok, we have a good vm_area for this memory access, so diff -urN 2.4.10pre11/arch/sparc/mm/fault.c silent-stack-overflow/arch/sparc/mm/fault.c --- 2.4.10pre11/arch/sparc/mm/fault.c Sat Aug 11 08:04:01 2001 +++ silent-stack-overflow/arch/sparc/mm/fault.c Tue Sep 18 10:08:51 2001 @@ -238,7 +238,7 @@ goto good_area; if(!(vma->vm_flags & VM_GROWSDOWN)) goto bad_area; - if(expand_stack(vma, address)) + if(expand_stack(vma, address, NULL)) goto bad_area; /* * Ok, we have a good vm_area for this memory access, so @@ -485,7 +485,7 @@ goto good_area; if(!(vma->vm_flags & VM_GROWSDOWN)) goto bad_area; - if(expand_stack(vma, address)) + if(expand_stack(vma, address, NULL)) goto bad_area; good_area: info.si_code = SEGV_ACCERR; diff -urN 2.4.10pre11/arch/sparc64/mm/fault.c silent-stack-overflow/arch/sparc64/mm/fault.c --- 2.4.10pre11/arch/sparc64/mm/fault.c Tue Sep 18 02:42:20 2001 +++ silent-stack-overflow/arch/sparc64/mm/fault.c Tue Sep 18 10:08:51 2001 @@ -340,7 +340,7 @@ goto good_area; if (!(vma->vm_flags & VM_GROWSDOWN)) goto bad_area; - if (expand_stack(vma, address)) + if (expand_stack(vma, address, NULL)) goto bad_area; /* * Ok, we have a good vm_area for this memory access, so diff -urN 2.4.10pre11/include/linux/mm.h silent-stack-overflow/include/linux/mm.h --- 2.4.10pre11/include/linux/mm.h Tue Sep 18 02:43:02 2001 +++ silent-stack-overflow/include/linux/mm.h Tue Sep 18 10:10:24 2001 @@ -572,11 +572,24 @@ #define GFP_DMA __GFP_DMA -/* vma is the first one with address < vma->vm_end, - * and even address < vma->vm_start. Have to extend vma. */ -static inline int expand_stack(struct vm_area_struct * vma, unsigned long address) +extern int heap_stack_gap; + +/* + * vma is the first one with address < vma->vm_end, + * and even address < vma->vm_start. Have to extend vma. + * + * Locking: vm_start can decrease under you if you only hold + * the read semaphore, you either need the write semaphore + * or both the read semaphore and the page_table_lock acquired + * if you want vm_start consistent. vm_end and the vma layout + * are just consistent with only the read semaphore acquired + * instead. + */ +static inline int expand_stack(struct vm_area_struct * vma, unsigned long address, + struct vm_area_struct * prev_vma) { unsigned long grow; + int err = -ENOMEM; /* * vma->vm_start/vm_end cannot change under us because the caller is required @@ -584,18 +597,22 @@ * before relocating the vma range ourself. */ address &= PAGE_MASK; + if (prev_vma && prev_vma->vm_end + (heap_stack_gap << PAGE_SHIFT) > address) + goto out; + spin_lock(&vma->vm_mm->page_table_lock); grow = (vma->vm_start - address) >> PAGE_SHIFT; if (vma->vm_end - address > current->rlim[RLIMIT_STACK].rlim_cur || ((vma->vm_mm->total_vm + grow) << PAGE_SHIFT) > current->rlim[RLIMIT_AS].rlim_cur) - return -ENOMEM; - spin_lock(&vma->vm_mm->page_table_lock); + goto out_unlock; vma->vm_start = address; - vma->vm_pgoff -= grow; vma->vm_mm->total_vm += grow; if (vma->vm_flags & VM_LOCKED) vma->vm_mm->locked_vm += grow; + err = 0; + out_unlock: spin_unlock(&vma->vm_mm->page_table_lock); - return 0; + out: + return err; } /* Look up the first VMA which satisfies addr < vm_end, NULL if none. */ diff -urN 2.4.10pre11/include/linux/sysctl.h silent-stack-overflow/include/linux/sysctl.h --- 2.4.10pre11/include/linux/sysctl.h Tue Sep 18 02:43:03 2001 +++ silent-stack-overflow/include/linux/sysctl.h Tue Sep 18 10:08:51 2001 @@ -136,7 +136,8 @@ VM_PAGECACHE=7, /* struct: Set cache memory thresholds */ VM_PAGERDAEMON=8, /* struct: Control kswapd behaviour */ VM_PGT_CACHE=9, /* struct: Set page table cache parameters */ - VM_PAGE_CLUSTER=10 /* int: set number of pages to swap together */ + VM_PAGE_CLUSTER=10, /* int: set number of pages to swap together */ + VM_HEAP_STACK_GAP=11, /* int: page gap between heap and stack */ }; diff -urN 2.4.10pre11/kernel/sysctl.c silent-stack-overflow/kernel/sysctl.c --- 2.4.10pre11/kernel/sysctl.c Tue Sep 18 02:43:04 2001 +++ silent-stack-overflow/kernel/sysctl.c Tue Sep 18 10:08:51 2001 @@ -265,6 +265,8 @@ &pgt_cache_water, 2*sizeof(int), 0644, NULL, &proc_dointvec}, {VM_PAGE_CLUSTER, "page-cluster", &page_cluster, sizeof(int), 0644, NULL, &proc_dointvec}, + {VM_HEAP_STACK_GAP, "heap-stack-gap", + &heap_stack_gap, sizeof(int), 0644, NULL, &proc_dointvec}, {0} }; diff -urN 2.4.10pre11/mm/memory.c silent-stack-overflow/mm/memory.c --- 2.4.10pre11/mm/memory.c Tue Sep 18 02:43:04 2001 +++ silent-stack-overflow/mm/memory.c Tue Sep 18 10:08:51 2001 @@ -444,7 +444,7 @@ unsigned long ptr, end; int err; struct mm_struct * mm; - struct vm_area_struct * vma = 0; + struct vm_area_struct * vma, * prev_vma; struct page * map; int i; int datain = (rw == READ); @@ -470,19 +470,21 @@ iobuf->length = len; i = 0; + vma = NULL; /* * First of all, try to fault in all of the necessary pages */ while (ptr < end) { if (!vma || ptr >= vma->vm_end) { - vma = find_vma(current->mm, ptr); + vma = find_vma(mm, ptr); if (!vma) goto out_unlock; if (vma->vm_start > ptr) { if (!(vma->vm_flags & VM_GROWSDOWN)) goto out_unlock; - if (expand_stack(vma, ptr)) + find_vma_prev(mm, ptr, &prev_vma); + if (expand_stack(vma, ptr, prev_vma)) goto out_unlock; } if (((datain) && (!(vma->vm_flags & VM_WRITE))) || diff -urN 2.4.10pre11/mm/mmap.c silent-stack-overflow/mm/mmap.c --- 2.4.10pre11/mm/mmap.c Tue Sep 18 02:43:04 2001 +++ silent-stack-overflow/mm/mmap.c Tue Sep 18 10:12:08 2001 @@ -45,6 +45,7 @@ }; int sysctl_overcommit_memory; +int heap_stack_gap = 1; /* Check that a process has enough memory to allocate a * new virtual mapping. @@ -606,9 +607,15 @@ for (vma = find_vma(current->mm, addr); ; vma = vma->vm_next) { /* At this point: (!vma || addr < vma->vm_end). */ + unsigned long __heap_stack_gap; if (TASK_SIZE - len < addr) return -ENOMEM; - if (!vma || addr + len <= vma->vm_start) + if (!vma) + return addr; + __heap_stack_gap = 0; + if (vma->vm_flags & VM_GROWSDOWN) + __heap_stack_gap = heap_stack_gap << PAGE_SHIFT; + if (addr + len + __heap_stack_gap <= vma->vm_start) return addr; addr = vma->vm_end; } @@ -717,7 +724,7 @@ struct vm_area_struct * find_extend_vma(struct mm_struct * mm, unsigned long addr) { - struct vm_area_struct * vma; + struct vm_area_struct * vma, * prev_vma; unsigned long start; addr &= PAGE_MASK; @@ -728,9 +735,10 @@ return vma; if (!(vma->vm_flags & VM_GROWSDOWN)) return NULL; - start = vma->vm_start; - if (expand_stack(vma, addr)) + find_vma_prev(mm, addr, &prev_vma); + if (expand_stack(vma, addr, prev_vma)) return NULL; + start = vma->vm_start; if (vma->vm_flags & VM_LOCKED) { make_pages_present(addr, start); }