From: Greg Kroah-Hartman Date: Tue, 18 Jul 2017 16:17:29 +0000 (+0200) Subject: 4.12-stable patches X-Git-Tag: v4.12.3~13 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=88444e3ae733b25a9d57763559f696fbe73d0293;p=thirdparty%2Fkernel%2Fstable-queue.git 4.12-stable patches added patches: mm-fix-overflow-check-in-expand_upwards.patch --- diff --git a/queue-4.12/mm-fix-overflow-check-in-expand_upwards.patch b/queue-4.12/mm-fix-overflow-check-in-expand_upwards.patch new file mode 100644 index 00000000000..daf11b4edd8 --- /dev/null +++ b/queue-4.12/mm-fix-overflow-check-in-expand_upwards.patch @@ -0,0 +1,49 @@ +From 37511fb5c91db93d8bd6e3f52f86e5a7ff7cfcdf Mon Sep 17 00:00:00 2001 +From: Helge Deller +Date: Fri, 14 Jul 2017 14:49:38 -0700 +Subject: mm: fix overflow check in expand_upwards() +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Helge Deller + +commit 37511fb5c91db93d8bd6e3f52f86e5a7ff7cfcdf upstream. + +Jörn Engel noticed that the expand_upwards() function might not return +-ENOMEM in case the requested address is (unsigned long)-PAGE_SIZE and +if the architecture didn't defined TASK_SIZE as multiple of PAGE_SIZE. + +Affected architectures are arm, frv, m68k, blackfin, h8300 and xtensa +which all define TASK_SIZE as 0xffffffff, but since none of those have +an upwards-growing stack we currently have no actual issue. + +Nevertheless let's fix this just in case any of the architectures with +an upward-growing stack (currently parisc, metag and partly ia64) define +TASK_SIZE similar. + +Link: http://lkml.kernel.org/r/20170702192452.GA11868@p100.box +Fixes: bd726c90b6b8 ("Allow stack to grow up to address space limit") +Signed-off-by: Helge Deller +Reported-by: Jörn Engel +Cc: Hugh Dickins +Cc: Oleg Nesterov +Signed-off-by: Andrew Morton +Signed-off-by: Linus Torvalds +Signed-off-by: Greg Kroah-Hartman + +--- + mm/mmap.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/mm/mmap.c ++++ b/mm/mmap.c +@@ -2232,7 +2232,7 @@ int expand_upwards(struct vm_area_struct + + /* Guard against exceeding limits of the address space. */ + address &= PAGE_MASK; +- if (address >= TASK_SIZE) ++ if (address >= (TASK_SIZE & PAGE_MASK)) + return -ENOMEM; + address += PAGE_SIZE; + diff --git a/queue-4.12/series b/queue-4.12/series index 3ab00425165..81c69e624c9 100644 --- a/queue-4.12/series +++ b/queue-4.12/series @@ -62,3 +62,4 @@ mnt-in-umount-propagation-reparent-in-a-separate-pass.patch mnt-in-propgate_umount-handle-visiting-mounts-in-any-order.patch mnt-make-propagate_umount-less-slow-for-overlapping-mount-propagation-trees.patch selftests-capabilities-fix-the-test_execve-test.patch +mm-fix-overflow-check-in-expand_upwards.patch