[PATCH] mm/mmap: Fix vma_merge() offset when expanding the next vma

[Liam R. Howlett]

The vm_pgoff was being set incorrectly when expanding the next VMA to a
lower address.  Fix the issue by using the mid->vm_pgoff value for this
merge case (aka case 8).  Note that this does not change case 3's
vm_pgoff as next and mid are the same VMA.

Reported-by: Sanan Hasanov <sanan.hasanov@xxxxxxxxxxxxxxx>
Link: https://lore.kernel.org/linux-mm/IA1PR07MB983017D2FBA174D2FF78CEB6ABCE9@xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx/
Cc: Matthew Wilcox <willy@xxxxxxxxxxxxx>
Cc: David Hildenbrand <david@xxxxxxxxxx>
Cc: Hugh Dickins <hughd@xxxxxxxxxx>
Signed-off-by: Liam R. Howlett <Liam.Howlett@xxxxxxxxxx>
---
 mm/mmap.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/mm/mmap.c b/mm/mmap.c
index 00d90bbc250e..614ea2d93b0a 100644
--- a/mm/mmap.c
+++ b/mm/mmap.c
@@ -978,7 +978,7 @@ struct vm_area_struct *vma_merge(struct vma_iterator *vmi, struct mm_struct *mm,
 			vma = next;			/* case 3 */
 			vma_start = addr;
 			vma_end = next->vm_end;
-			vma_pgoff = next->vm_pgoff;
+			vma_pgoff = mid->vm_pgoff;
 			err = 0;
 			if (mid != next) {		/* case 8 */
 				remove = mid;
-- 
2.39.0