Re: Please include commit 90481622d7 in 3.3-stable

[Ben Hutchings <ben@decadent.org.uk>]

[-- Attachment #1: Type: text/plain, Size: 1621 bytes --]

On Sat, 2012-05-12 at 09:34 +0100, Ben Hutchings wrote:
> On Thu, 2012-05-10 at 19:58 +1000, Paul Mackerras wrote:
> > Please include commit 90481622d7 ("hugepages: fix use after free bug
> > in "quota" handling") from Linus' tree in the next 3.3 stable release.
> > It applies without fuzz, though with offsets.
> > 
> > It fixes a use-after-free bug in the huge page code that we are
> > hitting when using KVM on IBM Power machines with large pages backing
> > the guests, though it can in principle be hit in other ways also.
> > Since it's a use-after-free bug, it tends to result in an immediate
> > kernel crash if you have slab debug turned on, or occasional
> > hard-to-debug memory corruption if you don't.
> > 
> > The bug is also present in earlier kernels, and the patch should
> > apply at least to 3.2.  It would be good if it can be applied to
> > earlier kernels also.
> 
> I tried cherry-picking this on top of 3.2.17, but there was a conflict
> in unmap_ref_private().  It looks like all of these belong in 3.2.y as
> well:
> 
> 1e16a53 mm/hugetlb.c: fix virtual address handling in hugetlb fault
> 0c176d5 mm: hugetlb: fix pgoff computation when unmapping page from vma
> ea5768c mm/hugetlb.c: avoid bogus counter of surplus huge page
> 409eb8c mm/hugetlb.c: undo change to page mapcount in fault handler
> cd2934a flush_tlb_range() needs ->page_table_lock when ->mmap_sem is not held

Sorry, I didn't make myself clear.  I'm asking for confirmation: should
these all be applied to 3.2.y?

Ben.

-- 
Ben Hutchings
You can't have everything.  Where would you put it?

[-- Attachment #2: This is a digitally signed message part --]
[-- Type: application/pgp-signature, Size: 828 bytes --]