releases/4.4.157/kthread-fix-boot-hang-regression-on-mips-openrisc.patch

   1 From b0f5a8f32e8bbdaae1abb8abe2d3cbafaba57e08 Mon Sep 17 00:00:00 2001
   2 From: Vegard Nossum <vegard.nossum@oracle.com>
   3 Date: Mon, 29 May 2017 09:22:07 +0200
   4 Subject: kthread: fix boot hang (regression) on MIPS/OpenRISC
   5
   6 From: Vegard Nossum <vegard.nossum@oracle.com>
   7
   8 commit b0f5a8f32e8bbdaae1abb8abe2d3cbafaba57e08 upstream.
   9
  10 This fixes a regression in commit 4d6501dce079 where I didn't notice
  11 that MIPS and OpenRISC were reinitialising p->{set,clear}_child_tid to
  12 NULL after our initialisation in copy_process().
  13
  14 We can simply get rid of the arch-specific initialisation here since it
  15 is now always done in copy_process() before hitting copy_thread{,_tls}().
  16
  17 Review notes:
  18
  19  - As far as I can tell, copy_process() is the only user of
  20    copy_thread_tls(), which is the only caller of copy_thread() for
  21    architectures that don't implement copy_thread_tls().
  22
  23  - After this patch, there is no arch-specific code touching
  24    p->set_child_tid or p->clear_child_tid whatsoever.
  25
  26  - It may look like MIPS/OpenRISC wanted to always have these fields be
  27    NULL, but that's not true, as copy_process() would unconditionally
  28    set them again _after_ calling copy_thread_tls() before commit
  29    4d6501dce079.
  30
  31 Fixes: 4d6501dce079c1eb6bf0b1d8f528a5e81770109e ("kthread: Fix use-after-free if kthread fork fails")
  32 Reported-by: Guenter Roeck <linux@roeck-us.net>
  33 Tested-by: Guenter Roeck <linux@roeck-us.net> # MIPS only
  34 Acked-by: Stafford Horne <shorne@gmail.com>
  35 Acked-by: Oleg Nesterov <oleg@redhat.com>
  36 Cc: Ralf Baechle <ralf@linux-mips.org>
  37 Cc: linux-mips@linux-mips.org
  38 Cc: Jonas Bonn <jonas@southpole.se>
  39 Cc: Stefan Kristiansson <stefan.kristiansson@saunalahti.fi>
  40 Cc: openrisc@lists.librecores.org
  41 Cc: Jamie Iles <jamie.iles@oracle.com>
  42 Cc: Thomas Gleixner <tglx@linutronix.de>
  43 Signed-off-by: Vegard Nossum <vegard.nossum@oracle.com>
  44 Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
  45 Signed-off-by: Amit Pundir <amit.pundir@linaro.org>
  46 Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
  47
  48 ---
  49  arch/mips/kernel/process.c     |    1 -
  50  arch/openrisc/kernel/process.c |    2 --
  51  2 files changed, 3 deletions(-)
  52
  53 --- a/arch/mips/kernel/process.c
  54 +++ b/arch/mips/kernel/process.c
  55 @@ -115,7 +115,6 @@ int copy_thread(unsigned long clone_flag
  56         struct thread_info *ti = task_thread_info(p);
  57         struct pt_regs *childregs, *regs = current_pt_regs();
  58         unsigned long childksp;
  59 -       p->set_child_tid = p->clear_child_tid = NULL;
  60
  61         childksp = (unsigned long)task_stack_page(p) + THREAD_SIZE - 32;
  62
  63 --- a/arch/openrisc/kernel/process.c
  64 +++ b/arch/openrisc/kernel/process.c
  65 @@ -152,8 +152,6 @@ copy_thread(unsigned long clone_flags, u
  66
  67         top_of_kernel_stack = sp;
  68
  69 -       p->set_child_tid = p->clear_child_tid = NULL;
  70 -
  71         /* Locate userspace context on stack... */
  72         sp -= STACK_FRAME_OVERHEAD;     /* redzone */
  73         sp -= sizeof(struct pt_regs);