From bf77b94c99ad5df0d97a52522fc7a220c0bf44fe Mon Sep 17 00:00:00 2001 From: Oleg Nesterov Date: Mon, 13 Oct 2014 15:54:12 -0700 Subject: [PATCH] ipc/shm: kill the historical/wrong mm->start_stack check do_shmat() is the only user of ->start_stack (proc just reports its value), and this check looks ugly and wrong. The reason for this check is not clear at all, and it wrongly assumes that the stack can only grow down. But the main problem is that in general mm->start_stack has nothing to do with stack_vma->vm_start. Not only the application can switch to another stack and even unmap this area, setup_arg_pages() expands the stack without updating mm->start_stack during exec(). This means that in the likely case "addr > start_stack - size - PAGE_SIZE * 5" is simply impossible after find_vma_intersection() == F, or the stack can't grow anyway because of RLIMIT_STACK. Many thanks to Hugh for his explanations. Signed-off-by: Oleg Nesterov Acked-by: Hugh Dickins Cc: Cyrill Gorcunov Cc: Davidlohr Bueso Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds --- ipc/shm.c | 7 ------- 1 file changed, 7 deletions(-) diff --git a/ipc/shm.c b/ipc/shm.c index 7fc9f9f3a26b..01454796ba3c 100644 --- a/ipc/shm.c +++ b/ipc/shm.c @@ -1172,13 +1172,6 @@ long do_shmat(int shmid, char __user *shmaddr, int shmflg, ulong *raddr, if (find_vma_intersection(current->mm, addr, addr + size)) goto invalid; - /* - * If shm segment goes below stack, make sure there is some - * space left for the stack to grow (at least 4 pages). - */ - if (addr < current->mm->start_stack && - addr > current->mm->start_stack - size - PAGE_SIZE * 5) - goto invalid; } addr = do_mmap_pgoff(file, addr, size, prot, flags, 0, &populate); -- 2.30.2