[PATCH] userfaultfd: mcopy_atomic: update cases returning -ENOENT

[Mike Rapoport]

As Andrea commented in [1], if the VMA covering the address was unmapped,
we may end up with a VMA a way above the faulting address. In this case we
would like to return -ENOENT to allow uffd monitor detection of VMA
removal.

[1] http://www.spinics.net/lists/linux-mm/msg121267.html

Signed-off-by: Mike Rapoport <rppt@xxxxxxxxxxxxxxxxxx>
---
 mm/userfaultfd.c | 14 ++++++++------
 1 file changed, 8 insertions(+), 6 deletions(-)

diff --git a/mm/userfaultfd.c b/mm/userfaultfd.c
index b861cf9..cf43456 100644
--- a/mm/userfaultfd.c
+++ b/mm/userfaultfd.c
@@ -206,6 +206,10 @@ static __always_inline ssize_t __mcopy_atomic_hugetlb(struct mm_struct *dst_mm,
 		if (!dst_vma->vm_userfaultfd_ctx.ctx)
 			goto out_unlock;
 
+		if (dst_start < dst_vma->vm_start ||
+		    dst_start + len > dst_vma->vm_end)
+			goto out_unlock;
+
 		err = -EINVAL;
 		if (vma_hpagesize != vma_kernel_pagesize(dst_vma))
 			goto out_unlock;
@@ -216,9 +220,6 @@ static __always_inline ssize_t __mcopy_atomic_hugetlb(struct mm_struct *dst_mm,
 		 */
 		if (dst_vma->vm_flags & VM_SHARED)
 			goto out_unlock;
-		if (dst_start < dst_vma->vm_start ||
-		    dst_start + len > dst_vma->vm_end)
-			goto out_unlock;
 	}
 
 	if (WARN_ON(dst_addr & (vma_hpagesize - 1) ||
@@ -385,13 +386,14 @@ static __always_inline ssize_t __mcopy_atomic(struct mm_struct *dst_mm,
 	if (!dst_vma->vm_userfaultfd_ctx.ctx)
 		goto out_unlock;
 
-	err = -EINVAL;
-	if (!vma_is_shmem(dst_vma) && dst_vma->vm_flags & VM_SHARED)
-		goto out_unlock;
 	if (dst_start < dst_vma->vm_start ||
 	    dst_start + len > dst_vma->vm_end)
 		goto out_unlock;
 
+	err = -EINVAL;
+	if (!vma_is_shmem(dst_vma) && dst_vma->vm_flags & VM_SHARED)
+		goto out_unlock;
+
 	/*
 	 * If this is a HUGETLB vma, pass off to appropriate routine
 	 */
-- 
1.9.1