Re: Please include commit 90481622d7 in 3.3-stable

[Ben Hutchings <ben@decadent.org.uk>]

[-- Attachment #1: Type: text/plain, Size: 1506 bytes --]

On Thu, 2012-05-10 at 19:58 +1000, Paul Mackerras wrote:
> Please include commit 90481622d7 ("hugepages: fix use after free bug
> in "quota" handling") from Linus' tree in the next 3.3 stable release.
> It applies without fuzz, though with offsets.
> 
> It fixes a use-after-free bug in the huge page code that we are
> hitting when using KVM on IBM Power machines with large pages backing
> the guests, though it can in principle be hit in other ways also.
> Since it's a use-after-free bug, it tends to result in an immediate
> kernel crash if you have slab debug turned on, or occasional
> hard-to-debug memory corruption if you don't.
> 
> The bug is also present in earlier kernels, and the patch should
> apply at least to 3.2.  It would be good if it can be applied to
> earlier kernels also.

I tried cherry-picking this on top of 3.2.17, but there was a conflict
in unmap_ref_private().  It looks like all of these belong in 3.2.y as
well:

1e16a53 mm/hugetlb.c: fix virtual address handling in hugetlb fault
0c176d5 mm: hugetlb: fix pgoff computation when unmapping page from vma
ea5768c mm/hugetlb.c: avoid bogus counter of surplus huge page
409eb8c mm/hugetlb.c: undo change to page mapcount in fault handler
cd2934a flush_tlb_range() needs ->page_table_lock when ->mmap_sem is not held

Ben.

-- 
Ben Hutchings
Experience is directly proportional to the value of equipment destroyed.
                                                         - Carolyn Scheppner

[-- Attachment #2: This is a digitally signed message part --]
[-- Type: application/pgp-signature, Size: 828 bytes --]