if ((mm->total_vm << PAGE_SHIFT) + len > current->signal->rlim[RLIMIT_AS].rlim_cur) 
if (!may_expand_vm(mm, len >> PAGE_SHIFT)) 
unsigned long do_mmap_pgoff(struct file * file, unsigned long addr,			unsigned long len, unsigned long prot,			unsigned long flags, unsigned long pgoff){	struct mm_struct * mm = current->mm;	struct vm_area_struct * vma, * prev;	struct inode *inode;	unsigned int vm_flags;	int correct_wcount = 0;	int error;	struct rb_node ** rb_link, * rb_parent;	int accountable = 1;	unsigned long charged = 0, reqprot = prot;	if (file) {		if (is_file_hugepages(file))			accountable = 0;		if (!file->f_op || !file->f_op->mmap)			return -ENODEV;		if ((prot & PROT_EXEC) &&		    (file->f_vfsmnt->mnt_flags & MNT_NOEXEC))			return -EPERM;	}	/*	 * Does the application expect PROT_READ to imply PROT_EXEC?	 *	 * (the exception is when the underlying filesystem is noexec	 *  mounted, in which case we dont add PROT_EXEC.)	 */	if ((prot & PROT_READ) && (current->personality & READ_IMPLIES_EXEC))		if (!(file && (file->f_vfsmnt->mnt_flags & MNT_NOEXEC)))			prot |= PROT_EXEC;	if (!len)		return -EINVAL;	/* Careful about overflows.. */	len = PAGE_ALIGN(len);	if (!len || len > TASK_SIZE)		return -ENOMEM;	/* offset overflow? */	if ((pgoff + (len >> PAGE_SHIFT)) < pgoff)               return -EOVERFLOW;	/* Too many mappings? */	if (mm->map_count > sysctl_max_map_count)		return -ENOMEM;	/* Obtain the address to map to. we verify (or select) it and ensure	 * that it represents a valid section of the address space.	 */	addr = get_unmapped_area(file, addr, len, pgoff, flags);	if (addr & ~PAGE_MASK)		return addr;	/* Do simple checking here so the lower-level routines won't have	 * to. we assume access permissions have been handled by the open	 * of the memory object, so we don't do any here.	 */	vm_flags = calc_vm_prot_bits(prot) | calc_vm_flag_bits(flags) |			mm->def_flags | VM_MAYREAD | VM_MAYWRITE | VM_MAYEXEC;	if (flags & MAP_LOCKED) {		if (!can_do_mlock())			return -EPERM;		vm_flags |= VM_LOCKED;	}	/* mlock MCL_FUTURE? */	if (vm_flags & VM_LOCKED) {		unsigned long locked, lock_limit;		locked = mm->locked_vm << PAGE_SHIFT;		lock_limit = current->signal->rlim[RLIMIT_MEMLOCK].rlim_cur;		locked += len;		if (locked > lock_limit && !capable(CAP_IPC_LOCK))			return -EAGAIN;	}	inode = file ? file->f_dentry->d_inode : NULL;	if (file) {		switch (flags & MAP_TYPE) {		case MAP_SHARED:			if ((prot&PROT_WRITE) && !(file->f_mode&FMODE_WRITE))				return -EACCES;			/*			 * Make sure we don't allow writing to an append-only			 * file..			 */			if (IS_APPEND(inode) && (file->f_mode & FMODE_WRITE))				return -EACCES;			/*			 * Make sure there are no mandatory locks on the file.			 */			if (locks_verify_locked(inode))				return -EAGAIN;			vm_flags |= VM_SHARED | VM_MAYSHARE;			if (!(file->f_mode & FMODE_WRITE))				vm_flags &= ~(VM_MAYWRITE | VM_SHARED);			/* fall through */		case MAP_PRIVATE:			if (!(file->f_mode & FMODE_READ))				return -EACCES;			break;		default:			return -EINVAL;		}	} else {		switch (flags & MAP_TYPE) {		case MAP_SHARED:			vm_flags |= VM_SHARED | VM_MAYSHARE;			break;		case MAP_PRIVATE:			/*			 * Set pgoff according to addr for anon_vma.			 */			pgoff = addr >> PAGE_SHIFT;			break;		default:			return -EINVAL;		}	}	error = security_file_mmap(file, reqprot, prot, flags);	if (error)		return error;			/* Clear old maps */	error = -ENOMEM;munmap_back:	vma = find_vma_prepare(mm, addr, &prev, &rb_link, &rb_parent);	if (vma && vma->vm_start < addr + len) {		if (do_munmap(mm, addr, len))			return -ENOMEM;		goto munmap_back;	}	/* Check against address space limit. */	if ((mm->total_vm << PAGE_SHIFT) + len	    > current->signal->rlim[RLIMIT_AS].rlim_cur)		return -ENOMEM;	if (accountable && (!(flags & MAP_NORESERVE) ||			    sysctl_overcommit_memory == OVERCOMMIT_NEVER)) {		if (vm_flags & VM_SHARED) {			/* Check memory availability in shmem_file_setup? */			vm_flags |= VM_ACCOUNT;		} else if (vm_flags & VM_WRITE) {			/*			 * Private writable mapping: check memory availability			 */			charged = len >> PAGE_SHIFT;			if (security_vm_enough_memory(charged))				return -ENOMEM;			vm_flags |= VM_ACCOUNT;		}	}	/*	 * Can we just expand an old private anonymous mapping?	 * The VM_SHARED test is necessary because shmem_zero_setup	 * will create the file object for a shared anonymous map below.	 */	if (!file && !(vm_flags & VM_SHARED) &&	    vma_merge(mm, prev, addr, addr + len, vm_flags,					NULL, NULL, pgoff, NULL))		goto out;	/*	 * Determine the object being mapped and call the appropriate	 * specific mapper. the address has already been validated, but	 * not unmapped, but the maps are removed from the list.	 */	vma = kmem_cache_alloc(vm_area_cachep, SLAB_KERNEL);	if (!vma) {		error = -ENOMEM;		goto unacct_error;	}	memset(vma, 0, sizeof(*vma));	vma->vm_mm = mm;	vma->vm_start = addr;	vma->vm_end = addr + len;	vma->vm_flags = vm_flags;	vma->vm_page_prot = protection_map[vm_flags & 0x0f];	vma->vm_pgoff = pgoff;	if (file) {		error = -EINVAL;		if (vm_flags & (VM_GROWSDOWN|VM_GROWSUP))			goto free_vma;		if (vm_flags & VM_DENYWRITE) {			error = deny_write_access(file);			if (error)				goto free_vma;			correct_wcount = 1;		}		vma->vm_file = file;		get_file(file);		error = file->f_op->mmap(file, vma);		if (error)			goto unmap_and_free_vma;	} else if (vm_flags & VM_SHARED) {		error = shmem_zero_setup(vma);		if (error)			goto free_vma;	}	/* We set VM_ACCOUNT in a shared mapping's vm_flags, to inform	 * shmem_zero_setup (perhaps called through /dev/zero's ->mmap)	 * that memory reservation must be checked; but that reservation	 * belongs to shared memory object, not to vma: so now clear it.	 */	if ((vm_flags & (VM_SHARED|VM_ACCOUNT)) == (VM_SHARED|VM_ACCOUNT))		vma->vm_flags &= ~VM_ACCOUNT;	/* Can addr have changed??	 *	 * Answer: Yes, several device drivers can do it in their	 *         f_op->mmap method. -DaveM	 */	addr = vma->vm_start;	pgoff = vma->vm_pgoff;	vm_flags = vma->vm_flags;	if (!file || !vma_merge(mm, prev, addr, vma->vm_end,			vma->vm_flags, NULL, file, pgoff, vma_policy(vma))) {		file = vma->vm_file;		vma_link(mm, vma, prev, rb_link, rb_parent);		if (correct_wcount)			atomic_inc(&inode->i_writecount);	} else {		if (file) {			if (correct_wcount)				atomic_inc(&inode->i_writecount);			fput(file);		}		mpol_free(vma_policy(vma));		kmem_cache_free(vm_area_cachep, vma);	}out:		mm->total_vm += len >> PAGE_SHIFT;	__vm_stat_account(mm, vm_flags, file, len >> PAGE_SHIFT);	if (vm_flags & VM_LOCKED) {		mm->locked_vm += len >> PAGE_SHIFT;		make_pages_present(addr, addr + len);	}	if (flags & MAP_POPULATE) {		up_write(&mm->mmap_sem);		sys_remap_file_pages(addr, len, 0,					pgoff, flags & MAP_NONBLOCK);		down_write(&mm->mmap_sem);	}	return addr;unmap_and_free_vma:	if (correct_wcount)		atomic_inc(&inode->i_writecount);	vma->vm_file = NULL;	fput(file);	/* Undo any partial mapping done by a device driver. */	unmap_region(mm, vma, prev, vma->vm_start, vma->vm_end);	charged = 0;free_vma:	kmem_cache_free(vm_area_cachep, vma);unacct_error:	if (charged)		vm_unacct_memory(charged);	return error;}
10457	/local/tlutelli/issta_data/temp/c/2005_temp/2005/10457/119f657c72fc07d6fd28c61de59cfba1566970a9/mmap.c/buggy/mm/mmap.c