From mboxrd@z Thu Jan  1 00:00:00 1970
Return-Path: <stable-owner@vger.kernel.org>
Received: from out4-smtp.messagingengine.com ([66.111.4.28]:52085 "EHLO
        out4-smtp.messagingengine.com" rhost-flags-OK-OK-OK-OK)
        by vger.kernel.org with ESMTP id S1751338AbdKVO5D (ORCPT
        <rfc822;stable@vger.kernel.org>); Wed, 22 Nov 2017 09:57:03 -0500
Date: Wed, 22 Nov 2017 15:57:07 +0100
From: Greg KH <greg@kroah.com>
To: Jann Horn <jannh@google.com>
Cc: stable@vger.kernel.org
Subject: Re: [PATCH] mm/pagewalk.c: report holes in hugetlb ranges
Message-ID: <20171122145707.GC8081@kroah.com>
References: <20171122135859.31114-1-jannh@google.com>
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
In-Reply-To: <20171122135859.31114-1-jannh@google.com>
Sender: stable-owner@vger.kernel.org
List-ID: <stable.vger.kernel.org>

On Wed, Nov 22, 2017 at 02:58:59PM +0100, Jann Horn wrote:
> commit 373c4557d2aa362702c4c2d41288fb1e54990b7c upstream.
> 
> This matters at least for the mincore syscall, which will otherwise copy
> uninitialized memory from the page allocator to userspace.  It is
> probably also a correctness error for /proc/$pid/pagemap, but I haven't
> tested that.
> 
> Removing the `walk->hugetlb_entry` condition in walk_hugetlb_range() has
> no effect because the caller already checks for that.
> 
> This only reports holes in hugetlb ranges to callers who have specified
> a hugetlb_entry callback.
> 
> This issue was found using an AFL-based fuzzer.
> 
> v2:
>  - don't crash on ->pte_hole==NULL (Andrew Morton)
>  - add Cc stable (Andrew Morton)
> 
> Changed for 4.4/4.9 stable backport:
>  - fix up conflict in the huge_pte_offset() call
> 
> Fixes: 1e25a271c8ac ("mincore: apply page table walker on do_mincore()")
> Signed-off-by: Jann Horn <jannh@google.com>
> ---
> Please apply this patch to <=4.9 stable trees instead of the
> original patch.

Thanks for the backport!

greg k-h