* [PATCH 3.14 01/11] Revert "can: fix handling of unmodifiable configuration options fix"
2016-09-09 15:33 ` [PATCH 3.14 00/11] 3.14.79-stable review Greg Kroah-Hartman
@ 2016-09-09 15:33 ` Greg Kroah-Hartman
2016-09-09 15:33 ` [PATCH 3.14 02/11] be2iscsi: Fix bogus WARN_ON length check Greg Kroah-Hartman
` (10 subsequent siblings)
11 siblings, 0 replies; 15+ messages in thread
From: Greg Kroah-Hartman @ 2016-09-09 15:33 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Willy Tarreau
3.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
This reverts commit 6f8f768a3586b6fbd50e249e7fe4f964a6994685 which was
bce271f255dae8335dc4d2ee2c4531e09cc67f5a upstream.
It was applied incorrectly, and isn't needed for 3.14-stable.
Reported-by: Willy Tarreau <w@1wt.eu>
Signed-off-by: Greg Kroah-Hartman gregkh@linuxfoundation.org
---
drivers/net/can/dev.c | 3 ---
1 file changed, 3 deletions(-)
--- a/drivers/net/can/dev.c
+++ b/drivers/net/can/dev.c
@@ -665,9 +665,6 @@ static int can_changelink(struct net_dev
}
}
- if (!data)
- return 0;
-
if (data[IFLA_CAN_CTRLMODE]) {
struct can_ctrlmode *cm;
^ permalink raw reply [flat|nested] 15+ messages in thread* [PATCH 3.14 02/11] be2iscsi: Fix bogus WARN_ON length check
2016-09-09 15:33 ` [PATCH 3.14 00/11] 3.14.79-stable review Greg Kroah-Hartman
2016-09-09 15:33 ` [PATCH 3.14 01/11] Revert "can: fix handling of unmodifiable configuration options fix" Greg Kroah-Hartman
@ 2016-09-09 15:33 ` Greg Kroah-Hartman
2016-09-09 15:33 ` [PATCH 3.14 03/11] HID: hid-input: Add parentheses to quell gcc warning Greg Kroah-Hartman
` (9 subsequent siblings)
11 siblings, 0 replies; 15+ messages in thread
From: Greg Kroah-Hartman @ 2016-09-09 15:33 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Tim Gardner, Jayamohan Kallickal,
Minh Tran, John Soni Jose, James E.J. Bottomley, Joel Stanley,
Manoj Kumar, Martin K. Petersen, Willy Tarreau
3.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tim Gardner <tim.gardner@canonical.com>
commit dd29dae00d39186890a5eaa2fe4ad8768bfd41a9 upstream.
drivers/scsi/be2iscsi/be_main.c: In function 'be_sgl_create_contiguous':
drivers/scsi/be2iscsi/be_main.c:3187:18: warning: logical not is only applied to the left hand side of comparison [-Wlogical-not-parentheses]
WARN_ON(!length > 0);
gcc version 5.2.1
Signed-off-by: Tim Gardner <tim.gardner@canonical.com>
Cc: Jayamohan Kallickal <jayamohan.kallickal@avagotech.com>
Cc: Minh Tran <minh.tran@avagotech.com>
Cc: John Soni Jose <sony.john-n@avagotech.com>
Cc: "James E.J. Bottomley" <JBottomley@odin.com>
Reported-by: Joel Stanley <joel@jms.id.au>
Reviewed-by: Manoj Kumar <manoj@linux.vnet.ibm.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Cc: Willy Tarreau <w@1wt.eu>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/scsi/be2iscsi/be_main.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/scsi/be2iscsi/be_main.c
+++ b/drivers/scsi/be2iscsi/be_main.c
@@ -3172,7 +3172,7 @@ be_sgl_create_contiguous(void *virtual_a
{
WARN_ON(!virtual_address);
WARN_ON(!physical_address);
- WARN_ON(!length > 0);
+ WARN_ON(!length);
WARN_ON(!sgl);
sgl->va = virtual_address;
^ permalink raw reply [flat|nested] 15+ messages in thread* [PATCH 3.14 03/11] HID: hid-input: Add parentheses to quell gcc warning
2016-09-09 15:33 ` [PATCH 3.14 00/11] 3.14.79-stable review Greg Kroah-Hartman
2016-09-09 15:33 ` [PATCH 3.14 01/11] Revert "can: fix handling of unmodifiable configuration options fix" Greg Kroah-Hartman
2016-09-09 15:33 ` [PATCH 3.14 02/11] be2iscsi: Fix bogus WARN_ON length check Greg Kroah-Hartman
@ 2016-09-09 15:33 ` Greg Kroah-Hartman
2016-09-09 15:33 ` [PATCH 3.14 04/11] ALSA: oxygen: Fix logical-not-parentheses warning Greg Kroah-Hartman
` (8 subsequent siblings)
11 siblings, 0 replies; 15+ messages in thread
From: Greg Kroah-Hartman @ 2016-09-09 15:33 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, James C Boyd, Jiri Kosina,
Willy Tarreau
3.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: James C Boyd <jcboyd.dev@gmail.com>
commit 09a5c34e8d6b05663ec4c3d22b1fbd9fec89aaf9 upstream.
GCC reports a -Wlogical-not-parentheses warning here; therefore
add parentheses to shut it up and to express our intent more.
Signed-off-by: James C Boyd <jcboyd.dev@gmail.com>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
Cc: Willy Tarreau <w@1wt.eu>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/hid/hid-input.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/hid/hid-input.c
+++ b/drivers/hid/hid-input.c
@@ -1084,7 +1084,7 @@ void hidinput_hid_event(struct hid_devic
return;
/* report the usage code as scancode if the key status has changed */
- if (usage->type == EV_KEY && !!test_bit(usage->code, input->key) != value)
+ if (usage->type == EV_KEY && (!!test_bit(usage->code, input->key)) != value)
input_event(input, EV_MSC, MSC_SCAN, usage->hid);
input_event(input, usage->type, usage->code, value);
^ permalink raw reply [flat|nested] 15+ messages in thread* [PATCH 3.14 04/11] ALSA: oxygen: Fix logical-not-parentheses warning
2016-09-09 15:33 ` [PATCH 3.14 00/11] 3.14.79-stable review Greg Kroah-Hartman
` (2 preceding siblings ...)
2016-09-09 15:33 ` [PATCH 3.14 03/11] HID: hid-input: Add parentheses to quell gcc warning Greg Kroah-Hartman
@ 2016-09-09 15:33 ` Greg Kroah-Hartman
2016-09-09 15:33 ` [PATCH 3.14 05/11] [media] stb6100: fix buffer length check in stb6100_write_reg_range() Greg Kroah-Hartman
` (7 subsequent siblings)
11 siblings, 0 replies; 15+ messages in thread
From: Greg Kroah-Hartman @ 2016-09-09 15:33 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Tomer Barletz, Takashi Iwai,
Willy Tarreau
3.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tomer Barletz <barletz@gmail.com>
commit 8ec7cfce3762299ae289c384e281b2f4010ae231 upstream.
This fixes the following warning, that is seen with gcc 5.1:
warning: logical not is only applied to the left hand side of comparison [-Wlogical-not-parentheses].
Signed-off-by: Tomer Barletz <barletz@gmail.com>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Cc: Willy Tarreau <w@1wt.eu>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
sound/pci/oxygen/oxygen_mixer.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/sound/pci/oxygen/oxygen_mixer.c
+++ b/sound/pci/oxygen/oxygen_mixer.c
@@ -88,7 +88,7 @@ static int dac_mute_put(struct snd_kcont
int changed;
mutex_lock(&chip->mutex);
- changed = !value->value.integer.value[0] != chip->dac_mute;
+ changed = (!value->value.integer.value[0]) != chip->dac_mute;
if (changed) {
chip->dac_mute = !value->value.integer.value[0];
chip->model.update_dac_mute(chip);
^ permalink raw reply [flat|nested] 15+ messages in thread* [PATCH 3.14 05/11] [media] stb6100: fix buffer length check in stb6100_write_reg_range()
2016-09-09 15:33 ` [PATCH 3.14 00/11] 3.14.79-stable review Greg Kroah-Hartman
` (3 preceding siblings ...)
2016-09-09 15:33 ` [PATCH 3.14 04/11] ALSA: oxygen: Fix logical-not-parentheses warning Greg Kroah-Hartman
@ 2016-09-09 15:33 ` Greg Kroah-Hartman
2016-09-09 15:33 ` [PATCH 3.14 06/11] ext4: validate that metadata blocks do not overlap superblock Greg Kroah-Hartman
` (6 subsequent siblings)
11 siblings, 0 replies; 15+ messages in thread
From: Greg Kroah-Hartman @ 2016-09-09 15:33 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Alexander Shiyan, Michael Krufky,
Mauro Carvalho Chehab, Willy Tarreau
3.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alexander Shiyan <shc_work@mail.ru>
commit 7e6bd12fb77b0067df13fb3ba3fadbdff2945396 upstream.
We are checking sizeof() the wrong variable!
Signed-off-by: Alexander Shiyan <shc_work@mail.ru>
Signed-off-by: Michael Krufky <mkrufky@linuxtv.org>
Signed-off-by: Mauro Carvalho Chehab <m.chehab@samsung.com>
Cc: Willy Tarreau <w@1wt.eu>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/media/dvb-frontends/stb6100.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/media/dvb-frontends/stb6100.c
+++ b/drivers/media/dvb-frontends/stb6100.c
@@ -193,7 +193,7 @@ static int stb6100_write_reg_range(struc
.len = len + 1
};
- if (1 + len > sizeof(buf)) {
+ if (1 + len > sizeof(cmdbuf)) {
printk(KERN_WARNING
"%s: i2c wr: len=%d is too big!\n",
KBUILD_MODNAME, len);
^ permalink raw reply [flat|nested] 15+ messages in thread* [PATCH 3.14 06/11] ext4: validate that metadata blocks do not overlap superblock
2016-09-09 15:33 ` [PATCH 3.14 00/11] 3.14.79-stable review Greg Kroah-Hartman
` (4 preceding siblings ...)
2016-09-09 15:33 ` [PATCH 3.14 05/11] [media] stb6100: fix buffer length check in stb6100_write_reg_range() Greg Kroah-Hartman
@ 2016-09-09 15:33 ` Greg Kroah-Hartman
2016-09-09 15:33 ` [PATCH 3.14 08/11] rds: fix an infoleak in rds_inc_info_copy Greg Kroah-Hartman
` (5 subsequent siblings)
11 siblings, 0 replies; 15+ messages in thread
From: Greg Kroah-Hartman @ 2016-09-09 15:33 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Theodore Tso
3.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Theodore Ts'o <tytso@mit.edu>
commit 829fa70dddadf9dd041d62b82cd7cea63943899d upstream.
A number of fuzzing failures seem to be caused by allocation bitmaps
or other metadata blocks being pointed at the superblock.
This can cause kernel BUG or WARNings once the superblock is
overwritten, so validate the group descriptor blocks to make sure this
doesn't happen.
Signed-off-by: Theodore Ts'o <tytso@mit.edu>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/ext4/super.c | 18 +++++++++++++++++-
1 file changed, 17 insertions(+), 1 deletion(-)
--- a/fs/ext4/super.c
+++ b/fs/ext4/super.c
@@ -2071,6 +2071,7 @@ void ext4_group_desc_csum_set(struct sup
/* Called at mount-time, super-block is locked */
static int ext4_check_descriptors(struct super_block *sb,
+ ext4_fsblk_t sb_block,
ext4_group_t *first_not_zeroed)
{
struct ext4_sb_info *sbi = EXT4_SB(sb);
@@ -2101,6 +2102,11 @@ static int ext4_check_descriptors(struct
grp = i;
block_bitmap = ext4_block_bitmap(sb, gdp);
+ if (block_bitmap == sb_block) {
+ ext4_msg(sb, KERN_ERR, "ext4_check_descriptors: "
+ "Block bitmap for group %u overlaps "
+ "superblock", i);
+ }
if (block_bitmap < first_block || block_bitmap > last_block) {
ext4_msg(sb, KERN_ERR, "ext4_check_descriptors: "
"Block bitmap for group %u not in group "
@@ -2108,6 +2114,11 @@ static int ext4_check_descriptors(struct
return 0;
}
inode_bitmap = ext4_inode_bitmap(sb, gdp);
+ if (inode_bitmap == sb_block) {
+ ext4_msg(sb, KERN_ERR, "ext4_check_descriptors: "
+ "Inode bitmap for group %u overlaps "
+ "superblock", i);
+ }
if (inode_bitmap < first_block || inode_bitmap > last_block) {
ext4_msg(sb, KERN_ERR, "ext4_check_descriptors: "
"Inode bitmap for group %u not in group "
@@ -2115,6 +2126,11 @@ static int ext4_check_descriptors(struct
return 0;
}
inode_table = ext4_inode_table(sb, gdp);
+ if (inode_table == sb_block) {
+ ext4_msg(sb, KERN_ERR, "ext4_check_descriptors: "
+ "Inode table for group %u overlaps "
+ "superblock", i);
+ }
if (inode_table < first_block ||
inode_table + sbi->s_itb_per_group - 1 > last_block) {
ext4_msg(sb, KERN_ERR, "ext4_check_descriptors: "
@@ -3869,7 +3885,7 @@ static int ext4_fill_super(struct super_
goto failed_mount2;
}
}
- if (!ext4_check_descriptors(sb, &first_not_zeroed)) {
+ if (!ext4_check_descriptors(sb, logical_sb_block, &first_not_zeroed)) {
ext4_msg(sb, KERN_ERR, "group descriptors corrupted!");
goto failed_mount2;
}
^ permalink raw reply [flat|nested] 15+ messages in thread* [PATCH 3.14 08/11] rds: fix an infoleak in rds_inc_info_copy
2016-09-09 15:33 ` [PATCH 3.14 00/11] 3.14.79-stable review Greg Kroah-Hartman
` (5 preceding siblings ...)
2016-09-09 15:33 ` [PATCH 3.14 06/11] ext4: validate that metadata blocks do not overlap superblock Greg Kroah-Hartman
@ 2016-09-09 15:33 ` Greg Kroah-Hartman
2016-09-09 15:33 ` [PATCH 3.14 09/11] s390/sclp_ctl: fix potential information leak with /dev/sclp Greg Kroah-Hartman
` (4 subsequent siblings)
11 siblings, 0 replies; 15+ messages in thread
From: Greg Kroah-Hartman @ 2016-09-09 15:33 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Kangjie Lu, Santosh Shilimkar,
David S. Miller, Juerg Haefliger
3.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kangjie Lu <kangjielu@gmail.com>
commit 4116def2337991b39919f3b448326e21c40e0dbb upstream.
The last field "flags" of object "minfo" is not initialized.
Copying this object out may leak kernel stack data.
Assign 0 to it to avoid leak.
Signed-off-by: Kangjie Lu <kjlu@gatech.edu>
Acked-by: Santosh Shilimkar <santosh.shilimkar@oracle.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Juerg Haefliger <juerg.haefliger@hpe.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/rds/recv.c | 2 ++
1 file changed, 2 insertions(+)
--- a/net/rds/recv.c
+++ b/net/rds/recv.c
@@ -543,5 +543,7 @@ void rds_inc_info_copy(struct rds_incomi
minfo.fport = inc->i_hdr.h_dport;
}
+ minfo.flags = 0;
+
rds_info_copy(iter, &minfo, sizeof(minfo));
}
^ permalink raw reply [flat|nested] 15+ messages in thread* [PATCH 3.14 09/11] s390/sclp_ctl: fix potential information leak with /dev/sclp
2016-09-09 15:33 ` [PATCH 3.14 00/11] 3.14.79-stable review Greg Kroah-Hartman
` (6 preceding siblings ...)
2016-09-09 15:33 ` [PATCH 3.14 08/11] rds: fix an infoleak in rds_inc_info_copy Greg Kroah-Hartman
@ 2016-09-09 15:33 ` Greg Kroah-Hartman
2016-09-09 15:33 ` [PATCH 3.14 10/11] fix d_walk()/non-delayed __d_free() race Greg Kroah-Hartman
` (3 subsequent siblings)
11 siblings, 0 replies; 15+ messages in thread
From: Greg Kroah-Hartman @ 2016-09-09 15:33 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Pengfei Wang, Michael Holzheu,
Martin Schwidefsky, Juerg Haefliger
3.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Martin Schwidefsky <schwidefsky@de.ibm.com>
commit 532c34b5fbf1687df63b3fcd5b2846312ac943c6 upstream.
The sclp_ctl_ioctl_sccb function uses two copy_from_user calls to
retrieve the sclp request from user space. The first copy_from_user
fetches the length of the request which is stored in the first two
bytes of the request. The second copy_from_user gets the complete
sclp request, but this copies the length field a second time.
A malicious user may have changed the length in the meantime.
Reported-by: Pengfei Wang <wpengfeinudt@gmail.com>
Reviewed-by: Michael Holzheu <holzheu@linux.vnet.ibm.com>
Signed-off-by: Martin Schwidefsky <schwidefsky@de.ibm.com>
Signed-off-by: Juerg Haefliger <juerg.haefliger@hpe.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/s390/char/sclp_ctl.c | 12 +++++++-----
1 file changed, 7 insertions(+), 5 deletions(-)
--- a/drivers/s390/char/sclp_ctl.c
+++ b/drivers/s390/char/sclp_ctl.c
@@ -56,6 +56,7 @@ static int sclp_ctl_ioctl_sccb(void __us
{
struct sclp_ctl_sccb ctl_sccb;
struct sccb_header *sccb;
+ unsigned long copied;
int rc;
if (copy_from_user(&ctl_sccb, user_area, sizeof(ctl_sccb)))
@@ -65,14 +66,15 @@ static int sclp_ctl_ioctl_sccb(void __us
sccb = (void *) get_zeroed_page(GFP_KERNEL | GFP_DMA);
if (!sccb)
return -ENOMEM;
- if (copy_from_user(sccb, u64_to_uptr(ctl_sccb.sccb), sizeof(*sccb))) {
+ copied = PAGE_SIZE -
+ copy_from_user(sccb, u64_to_uptr(ctl_sccb.sccb), PAGE_SIZE);
+ if (offsetof(struct sccb_header, length) +
+ sizeof(sccb->length) > copied || sccb->length > copied) {
rc = -EFAULT;
goto out_free;
}
- if (sccb->length > PAGE_SIZE || sccb->length < 8)
- return -EINVAL;
- if (copy_from_user(sccb, u64_to_uptr(ctl_sccb.sccb), sccb->length)) {
- rc = -EFAULT;
+ if (sccb->length < 8) {
+ rc = -EINVAL;
goto out_free;
}
rc = sclp_sync_request(ctl_sccb.cmdw, sccb);
^ permalink raw reply [flat|nested] 15+ messages in thread* [PATCH 3.14 10/11] fix d_walk()/non-delayed __d_free() race
2016-09-09 15:33 ` [PATCH 3.14 00/11] 3.14.79-stable review Greg Kroah-Hartman
` (7 preceding siblings ...)
2016-09-09 15:33 ` [PATCH 3.14 09/11] s390/sclp_ctl: fix potential information leak with /dev/sclp Greg Kroah-Hartman
@ 2016-09-09 15:33 ` Greg Kroah-Hartman
2016-09-09 15:33 ` [PATCH 3.14 11/11] mm: thp: fix SMP race condition between THP page fault and MADV_DONTNEED Greg Kroah-Hartman
` (2 subsequent siblings)
11 siblings, 0 replies; 15+ messages in thread
From: Greg Kroah-Hartman @ 2016-09-09 15:33 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable
3.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Willy Tarreau <w@1wt.eu>
I checked Jari's explanation below and found that v3.14.77 and v3.12.62
are missing the same fix as 3.10. In fact Al's original commit 3d56c25
("fix d_walk()/non-delayed __d_free() race") used to mention to check
this __d_materialise_dentry() function in the Cc: stable line, but this
got lost during the backports.
Normally all of our 3 kernels need to apply the following patch that
Ben correctly put in 3.16 and 3.2. I'm fixing the backport in 3.10.103
right now.
On Mon, Aug 22, 2016 at 04:56:57PM +0300, Jari Ruusu wrote:
> This patch for 3.10 branch appears to be missing one important
>
> + dentry->d_flags |= DCACHE_RCUACCESS;
>
> in fs/dcache.c __d_materialise_dentry() function. When Ben Hutchings
> backported Al Viro's original fix to stable branches that he maintains,
> he added that one additional line to both 3.2 and 3.16 branches. Please
> consider including that additional one line fix for 3.10 stable branch
> also.
>
>
> Ben Hutchings said this on his 3.2.82-rc1 patch:
> [bwh: Backported to 3.2:
> - Adjust context
> - Also set the flag in __d_materialise_dentry())]
>
> http://marc.info/?l=linux-kernel&m=147117565612275&w=2
>
>
> Ben Hutchings said this on his 3.16.37-rc1 patch:
> [bwh: Backported to 3.16:
> - Adjust context
> - Also set the flag in __d_materialise_dentry())]
>
> http://marc.info/?l=linux-kernel&m=147117433412006&w=2
>
>
> Also mentioned by Sasha Levin on 3.18 and 4.1 commits:
> Cc: stable@vger.kernel.org # v3.2+ (and watch out for __d_materialise_dentry())
>
> http://marc.info/?l=linux-stable-commits&m=146648034410827&w=2
> http://marc.info/?l=linux-stable-commits&m=146647471009771&w=2
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/dcache.c | 1 +
1 file changed, 1 insertion(+)
--- a/fs/dcache.c
+++ b/fs/dcache.c
@@ -2652,6 +2652,7 @@ static void __d_materialise_dentry(struc
switch_names(dentry, anon);
swap(dentry->d_name.hash, anon->d_name.hash);
+ dentry->d_flags |= DCACHE_RCUACCESS;
dentry->d_parent = dentry;
list_del_init(&dentry->d_child);
anon->d_parent = dparent;
^ permalink raw reply [flat|nested] 15+ messages in thread* [PATCH 3.14 11/11] mm: thp: fix SMP race condition between THP page fault and MADV_DONTNEED
2016-09-09 15:33 ` [PATCH 3.14 00/11] 3.14.79-stable review Greg Kroah-Hartman
` (8 preceding siblings ...)
2016-09-09 15:33 ` [PATCH 3.14 10/11] fix d_walk()/non-delayed __d_free() race Greg Kroah-Hartman
@ 2016-09-09 15:33 ` Greg Kroah-Hartman
2016-09-09 22:32 ` [PATCH 3.14 00/11] 3.14.79-stable review Shuah Khan
2016-09-10 2:19 ` Guenter Roeck
11 siblings, 0 replies; 15+ messages in thread
From: Greg Kroah-Hartman @ 2016-09-09 15:33 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Andrea Arcangeli, Kirill A. Shutemov,
Andrew Morton, Linus Torvalds, Vlastimil Babka, Jiri Slaby
3.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Andrea Arcangeli <aarcange@redhat.com>
commit ad33bb04b2a6cee6c1f99fabb15cddbf93ff0433 upstream.
pmd_trans_unstable()/pmd_none_or_trans_huge_or_clear_bad() were
introduced to locklessy (but atomically) detect when a pmd is a regular
(stable) pmd or when the pmd is unstable and can infinitely transition
from pmd_none() and pmd_trans_huge() from under us, while only holding
the mmap_sem for reading (for writing not).
While holding the mmap_sem only for reading, MADV_DONTNEED can run from
under us and so before we can assume the pmd to be a regular stable pmd
we need to compare it against pmd_none() and pmd_trans_huge() in an
atomic way, with pmd_trans_unstable(). The old pmd_trans_huge() left a
tiny window for a race.
Useful applications are unlikely to notice the difference as doing
MADV_DONTNEED concurrently with a page fault would lead to undefined
behavior.
[js] 3.12 backport: no pmd_devmap in 3.12 yet.
[akpm@linux-foundation.org: tidy up comment grammar/layout]
Signed-off-by: Andrea Arcangeli <aarcange@redhat.com>
Reported-by: Kirill A. Shutemov <kirill.shutemov@linux.intel.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Cc: Vlastimil Babka <vbabka@suse.cz>
Signed-off-by: Jiri Slaby <jslaby@suse.cz>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
mm/memory.c | 14 ++++++++++++--
1 file changed, 12 insertions(+), 2 deletions(-)
--- a/mm/memory.c
+++ b/mm/memory.c
@@ -3770,8 +3770,18 @@ static int __handle_mm_fault(struct mm_s
if (unlikely(pmd_none(*pmd)) &&
unlikely(__pte_alloc(mm, vma, pmd, address)))
return VM_FAULT_OOM;
- /* if an huge pmd materialized from under us just retry later */
- if (unlikely(pmd_trans_huge(*pmd)))
+ /*
+ * If a huge pmd materialized under us just retry later. Use
+ * pmd_trans_unstable() instead of pmd_trans_huge() to ensure the pmd
+ * didn't become pmd_trans_huge under us and then back to pmd_none, as
+ * a result of MADV_DONTNEED running immediately after a huge pmd fault
+ * in a different thread of this mm, in turn leading to a misleading
+ * pmd_trans_huge() retval. All we have to ensure is that it is a
+ * regular pmd that we can walk with pte_offset_map() and we can do that
+ * through an atomic read in C, which is what pmd_trans_unstable()
+ * provides.
+ */
+ if (unlikely(pmd_trans_unstable(pmd)))
return 0;
/*
* A regular pmd is established and it can't morph into a huge pmd
^ permalink raw reply [flat|nested] 15+ messages in thread* Re: [PATCH 3.14 00/11] 3.14.79-stable review
2016-09-09 15:33 ` [PATCH 3.14 00/11] 3.14.79-stable review Greg Kroah-Hartman
` (9 preceding siblings ...)
2016-09-09 15:33 ` [PATCH 3.14 11/11] mm: thp: fix SMP race condition between THP page fault and MADV_DONTNEED Greg Kroah-Hartman
@ 2016-09-09 22:32 ` Shuah Khan
2016-09-10 7:17 ` Greg Kroah-Hartman
2016-09-10 2:19 ` Guenter Roeck
11 siblings, 1 reply; 15+ messages in thread
From: Shuah Khan @ 2016-09-09 22:32 UTC (permalink / raw)
To: Greg Kroah-Hartman, linux-kernel
Cc: torvalds, akpm, linux, patches, ben.hutchings, stable, Shuah Khan
On 09/09/2016 09:33 AM, Greg Kroah-Hartman wrote:
> ------------------------------------------------------
> NOTE:
> This is going to be the last 3.14.y kernel release. You should have
> moved off of it by now to a more "modern" kernel, like 4.4, or even
> better yet, 4.7 or newer. After this release, it will be considered
> end-of-life and not receive any more updates.
> ------------------------------------------------------
>
> This is the start of the stable review cycle for the 3.14.79 release.
> There are 11 patches in this series, all will be posted as a response
> to this one. If anyone has any issues with these being applied, please
> let me know.
>
> Responses should be made by Sun Sep 11 15:31:40 UTC 2016.
> Anything received after that time might be too late.
>
> The whole patch series can be found in one patch at:
> kernel.org/pub/linux/kernel/v3.x/stable-review/patch-3.14.79-rc1.gz
> or in the git tree and branch at:
> git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-3.14.y
> and the diffstat can be found below.
>
> thanks,
>
> greg k-h
>
Compiled and booted on my test system. No dmesg regressions.
thanks,
-- Shuah
--
Shuah Khan
Sr. Linux Kernel Developer
Open Source Innovation Group
Samsung Research America(Silicon Valley)
shuah.kh@samsung.com
^ permalink raw reply [flat|nested] 15+ messages in thread* Re: [PATCH 3.14 00/11] 3.14.79-stable review
2016-09-09 22:32 ` [PATCH 3.14 00/11] 3.14.79-stable review Shuah Khan
@ 2016-09-10 7:17 ` Greg Kroah-Hartman
0 siblings, 0 replies; 15+ messages in thread
From: Greg Kroah-Hartman @ 2016-09-10 7:17 UTC (permalink / raw)
To: Shuah Khan
Cc: linux-kernel, torvalds, akpm, linux, patches, ben.hutchings,
stable
On Fri, Sep 09, 2016 at 04:32:25PM -0600, Shuah Khan wrote:
> On 09/09/2016 09:33 AM, Greg Kroah-Hartman wrote:
> > ------------------------------------------------------
> > NOTE:
> > This is going to be the last 3.14.y kernel release. You should have
> > moved off of it by now to a more "modern" kernel, like 4.4, or even
> > better yet, 4.7 or newer. After this release, it will be considered
> > end-of-life and not receive any more updates.
> > ------------------------------------------------------
> >
> > This is the start of the stable review cycle for the 3.14.79 release.
> > There are 11 patches in this series, all will be posted as a response
> > to this one. If anyone has any issues with these being applied, please
> > let me know.
> >
> > Responses should be made by Sun Sep 11 15:31:40 UTC 2016.
> > Anything received after that time might be too late.
> >
> > The whole patch series can be found in one patch at:
> > kernel.org/pub/linux/kernel/v3.x/stable-review/patch-3.14.79-rc1.gz
> > or in the git tree and branch at:
> > git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-3.14.y
> > and the diffstat can be found below.
> >
> > thanks,
> >
> > greg k-h
> >
>
> Compiled and booted on my test system. No dmesg regressions.
Great, thanks for testing and letting me know.
greg k-h
^ permalink raw reply [flat|nested] 15+ messages in thread
* Re: [PATCH 3.14 00/11] 3.14.79-stable review
2016-09-09 15:33 ` [PATCH 3.14 00/11] 3.14.79-stable review Greg Kroah-Hartman
` (10 preceding siblings ...)
2016-09-09 22:32 ` [PATCH 3.14 00/11] 3.14.79-stable review Shuah Khan
@ 2016-09-10 2:19 ` Guenter Roeck
2016-09-10 7:17 ` Greg Kroah-Hartman
11 siblings, 1 reply; 15+ messages in thread
From: Guenter Roeck @ 2016-09-10 2:19 UTC (permalink / raw)
To: Greg Kroah-Hartman, linux-kernel
Cc: torvalds, akpm, shuah.kh, patches, ben.hutchings, stable
On 09/09/2016 08:33 AM, Greg Kroah-Hartman wrote:
> ------------------------------------------------------
> NOTE:
> This is going to be the last 3.14.y kernel release. You should have
> moved off of it by now to a more "modern" kernel, like 4.4, or even
> better yet, 4.7 or newer. After this release, it will be considered
> end-of-life and not receive any more updates.
> ------------------------------------------------------
>
> This is the start of the stable review cycle for the 3.14.79 release.
> There are 11 patches in this series, all will be posted as a response
> to this one. If anyone has any issues with these being applied, please
> let me know.
>
> Responses should be made by Sun Sep 11 15:31:40 UTC 2016.
> Anything received after that time might be too late.
>
Build results:
total: 131 pass: 131 fail: 0
Qemu test results:
total: 89 pass: 89 fail: 0
Details are available at http://kerneltests.org/builders.
Guenter
^ permalink raw reply [flat|nested] 15+ messages in thread* Re: [PATCH 3.14 00/11] 3.14.79-stable review
2016-09-10 2:19 ` Guenter Roeck
@ 2016-09-10 7:17 ` Greg Kroah-Hartman
0 siblings, 0 replies; 15+ messages in thread
From: Greg Kroah-Hartman @ 2016-09-10 7:17 UTC (permalink / raw)
To: Guenter Roeck
Cc: linux-kernel, torvalds, akpm, shuah.kh, patches, ben.hutchings,
stable
On Fri, Sep 09, 2016 at 07:19:40PM -0700, Guenter Roeck wrote:
> On 09/09/2016 08:33 AM, Greg Kroah-Hartman wrote:
> > ------------------------------------------------------
> > NOTE:
> > This is going to be the last 3.14.y kernel release. You should have
> > moved off of it by now to a more "modern" kernel, like 4.4, or even
> > better yet, 4.7 or newer. After this release, it will be considered
> > end-of-life and not receive any more updates.
> > ------------------------------------------------------
> >
> > This is the start of the stable review cycle for the 3.14.79 release.
> > There are 11 patches in this series, all will be posted as a response
> > to this one. If anyone has any issues with these being applied, please
> > let me know.
> >
> > Responses should be made by Sun Sep 11 15:31:40 UTC 2016.
> > Anything received after that time might be too late.
> >
>
> Build results:
> total: 131 pass: 131 fail: 0
> Qemu test results:
> total: 89 pass: 89 fail: 0
>
> Details are available at http://kerneltests.org/builders.
Wonderful, thanks for testing and letting me know.
greg k-h
^ permalink raw reply [flat|nested] 15+ messages in thread