From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Date: Wed, 22 Nov 2017 14:56:51 +0000 (+0100)
Subject: 4.4-stable patches
X-Git-Tag: v3.18.84~2
X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=7511dda720ffa57a68282624ebda594cc07c1b6b;p=thirdparty%2Fkernel%2Fstable-queue.git

4.4-stable patches

added patches:
	mm-pagewalk.c-report-holes-in-hugetlb-ranges.patch
---

diff --git a/queue-4.4/mm-pagewalk.c-report-holes-in-hugetlb-ranges.patch b/queue-4.4/mm-pagewalk.c-report-holes-in-hugetlb-ranges.patch
new file mode 100644
index 00000000000..bd883b6e6c4
--- /dev/null
+++ b/queue-4.4/mm-pagewalk.c-report-holes-in-hugetlb-ranges.patch
@@ -0,0 +1,55 @@
+From 373c4557d2aa362702c4c2d41288fb1e54990b7c Mon Sep 17 00:00:00 2001
+From: Jann Horn <jannh@google.com>
+Date: Tue, 14 Nov 2017 01:03:44 +0100
+Subject: mm/pagewalk.c: report holes in hugetlb ranges
+
+From: Jann Horn <jannh@google.com>
+
+commit 373c4557d2aa362702c4c2d41288fb1e54990b7c upstream.
+
+This matters at least for the mincore syscall, which will otherwise copy
+uninitialized memory from the page allocator to userspace.  It is
+probably also a correctness error for /proc/$pid/pagemap, but I haven't
+tested that.
+
+Removing the `walk->hugetlb_entry` condition in walk_hugetlb_range() has
+no effect because the caller already checks for that.
+
+This only reports holes in hugetlb ranges to callers who have specified
+a hugetlb_entry callback.
+
+This issue was found using an AFL-based fuzzer.
+
+v2:
+ - don't crash on ->pte_hole==NULL (Andrew Morton)
+ - add Cc stable (Andrew Morton)
+
+Changed for 4.4/4.9 stable backport:
+ - fix up conflict in the huge_pte_offset() call
+
+Fixes: 1e25a271c8ac ("mincore: apply page table walker on do_mincore()")
+Signed-off-by: Jann Horn <jannh@google.com>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+
+---
+ mm/pagewalk.c |    6 +++++-
+ 1 file changed, 5 insertions(+), 1 deletion(-)
+
+--- a/mm/pagewalk.c
++++ b/mm/pagewalk.c
+@@ -142,8 +142,12 @@ static int walk_hugetlb_range(unsigned l
+ 	do {
+ 		next = hugetlb_entry_end(h, addr, end);
+ 		pte = huge_pte_offset(walk->mm, addr & hmask);
+-		if (pte && walk->hugetlb_entry)
++
++		if (pte)
+ 			err = walk->hugetlb_entry(pte, hmask, addr, next, walk);
++		else if (walk->pte_hole)
++			err = walk->pte_hole(addr, next, walk);
++
+ 		if (err)
+ 			break;
+ 	} while (addr = next, addr != end);
diff --git a/queue-4.4/series b/queue-4.4/series
index f71071a6f0e..e80328eefd5 100644
--- a/queue-4.4/series
+++ b/queue-4.4/series
@@ -16,3 +16,4 @@ mm-page_alloc.c-broken-deferred-calculation.patch
 coda-fix-kernel-memory-exposure-attempt-in-fsync.patch
 mm-check-the-return-value-of-lookup_page_ext-for-all-call-sites.patch
 mm-page_ext.c-check-if-page_ext-is-not-prepared.patch
+mm-pagewalk.c-report-holes-in-hugetlb-ranges.patch