|
@@ -1536,9 +1536,14 @@ int expand_upwards(struct vm_area_struct *vma, unsigned long address)
|
|
|
* vma->vm_start/vm_end cannot change under us because the caller
|
|
|
* is required to hold the mmap_sem in read mode. We need the
|
|
|
* anon_vma lock to serialize against concurrent expand_stacks.
|
|
|
+ * Also guard against wrapping around to address 0.
|
|
|
*/
|
|
|
- address += 4 + PAGE_SIZE - 1;
|
|
|
- address &= PAGE_MASK;
|
|
|
+ if (address < PAGE_ALIGN(address+4))
|
|
|
+ address = PAGE_ALIGN(address+4);
|
|
|
+ else {
|
|
|
+ anon_vma_unlock(vma);
|
|
|
+ return -ENOMEM;
|
|
|
+ }
|
|
|
error = 0;
|
|
|
|
|
|
/* Somebody else might have raced and expanded it already */
|