From 0b0023e26909d2fc7e1a07fcfdc5be93294bb095 Mon Sep 17 00:00:00 2001 From: Greg Kroah-Hartman Date: Fri, 19 Apr 2013 11:38:54 -0700 Subject: [PATCH] 3.8-stable patches added patches: fs-binfmt_elf.c-fix-hugetlb-memory-check-in-vma_dump_size.patch hugetlbfs-add-swap-entry-check-in-follow_hugetlb_page.patch hugetlbfs-stop-setting-vm_dontdump-in-initializing-vma-vm_hugetlb.patch kernel-signal.c-stop-info-leak-via-the-tkill-and-the-tgkill-syscalls.patch --- ...ugetlb-memory-check-in-vma_dump_size.patch | 41 ++++++++++ ...p-entry-check-in-follow_hugetlb_page.patch | 75 +++++++++++++++++++ ...tdump-in-initializing-vma-vm_hugetlb.patch | 41 ++++++++++ ...ia-the-tkill-and-the-tgkill-syscalls.patch | 50 +++++++++++++ queue-3.8/series | 4 + 5 files changed, 211 insertions(+) create mode 100644 queue-3.8/fs-binfmt_elf.c-fix-hugetlb-memory-check-in-vma_dump_size.patch create mode 100644 queue-3.8/hugetlbfs-add-swap-entry-check-in-follow_hugetlb_page.patch create mode 100644 queue-3.8/hugetlbfs-stop-setting-vm_dontdump-in-initializing-vma-vm_hugetlb.patch create mode 100644 queue-3.8/kernel-signal.c-stop-info-leak-via-the-tkill-and-the-tgkill-syscalls.patch diff --git a/queue-3.8/fs-binfmt_elf.c-fix-hugetlb-memory-check-in-vma_dump_size.patch b/queue-3.8/fs-binfmt_elf.c-fix-hugetlb-memory-check-in-vma_dump_size.patch new file mode 100644 index 00000000000..80cf8514bb1 --- /dev/null +++ b/queue-3.8/fs-binfmt_elf.c-fix-hugetlb-memory-check-in-vma_dump_size.patch @@ -0,0 +1,41 @@ +From 23d9e482136e31c9d287633a6e473daa172767c4 Mon Sep 17 00:00:00 2001 +From: Naoya Horiguchi +Date: Wed, 17 Apr 2013 15:58:28 -0700 +Subject: fs/binfmt_elf.c: fix hugetlb memory check in vma_dump_size() + +From: Naoya Horiguchi + +commit 23d9e482136e31c9d287633a6e473daa172767c4 upstream. + +Documentation/filesystems/proc.txt says about coredump_filter bitmask, + + Note bit 0-4 doesn't effect any hugetlb memory. hugetlb memory are only + effected by bit 5-6. + +However current code can go into the subsequent flag checks of bit 0-4 +for vma(VM_HUGETLB). So this patch inserts 'return' and makes it work +as written in the document. + +Signed-off-by: Naoya Horiguchi +Reviewed-by: Rik van Riel +Acked-by: Michal Hocko +Reviewed-by: HATAYAMA Daisuke +Acked-by: KOSAKI Motohiro +Acked-by: David Rientjes +Signed-off-by: Andrew Morton +Signed-off-by: Linus Torvalds + +--- + fs/binfmt_elf.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/fs/binfmt_elf.c ++++ b/fs/binfmt_elf.c +@@ -1132,6 +1132,7 @@ static unsigned long vma_dump_size(struc + goto whole; + if (!(vma->vm_flags & VM_SHARED) && FILTER(HUGETLB_PRIVATE)) + goto whole; ++ return 0; + } + + /* Do not dump I/O mapped devices or special mappings */ diff --git a/queue-3.8/hugetlbfs-add-swap-entry-check-in-follow_hugetlb_page.patch b/queue-3.8/hugetlbfs-add-swap-entry-check-in-follow_hugetlb_page.patch new file mode 100644 index 00000000000..ca2a7752cac --- /dev/null +++ b/queue-3.8/hugetlbfs-add-swap-entry-check-in-follow_hugetlb_page.patch @@ -0,0 +1,75 @@ +From 9cc3a5bd40067b9a0fbd49199d0780463fc2140f Mon Sep 17 00:00:00 2001 +From: Naoya Horiguchi +Date: Wed, 17 Apr 2013 15:58:30 -0700 +Subject: hugetlbfs: add swap entry check in follow_hugetlb_page() + +From: Naoya Horiguchi + +commit 9cc3a5bd40067b9a0fbd49199d0780463fc2140f upstream. + +With applying the previous patch "hugetlbfs: stop setting VM_DONTDUMP in +initializing vma(VM_HUGETLB)" to reenable hugepage coredump, if a memory +error happens on a hugepage and the affected processes try to access the +error hugepage, we hit VM_BUG_ON(atomic_read(&page->_count) <= 0) in +get_page(). + +The reason for this bug is that coredump-related code doesn't recognise +"hugepage hwpoison entry" with which a pmd entry is replaced when a memory +error occurs on a hugepage. + +In other words, physical address information is stored in different bit +layout between hugepage hwpoison entry and pmd entry, so +follow_hugetlb_page() which is called in get_dump_page() returns a wrong +page from a given address. + +The expected behavior is like this: + + absent is_swap_pte FOLL_DUMP Expected behavior + ------------------------------------------------------------------- + true false false hugetlb_fault + false true false hugetlb_fault + false false false return page + true false true skip page (to avoid allocation) + false true true hugetlb_fault + false false true return page + +With this patch, we can call hugetlb_fault() and take proper actions (we +wait for migration entries, fail with VM_FAULT_HWPOISON_LARGE for +hwpoisoned entries,) and as the result we can dump all hugepages except +for hwpoisoned ones. + +Signed-off-by: Naoya Horiguchi +Cc: Rik van Riel +Acked-by: Michal Hocko +Cc: HATAYAMA Daisuke +Acked-by: KOSAKI Motohiro +Acked-by: David Rientjes +Signed-off-by: Andrew Morton +Signed-off-by: Linus Torvalds +Signed-off-by: Greg Kroah-Hartman + +--- + mm/hugetlb.c | 12 +++++++++++- + 1 file changed, 11 insertions(+), 1 deletion(-) + +--- a/mm/hugetlb.c ++++ b/mm/hugetlb.c +@@ -2965,7 +2965,17 @@ int follow_hugetlb_page(struct mm_struct + break; + } + +- if (absent || ++ /* ++ * We need call hugetlb_fault for both hugepages under migration ++ * (in which case hugetlb_fault waits for the migration,) and ++ * hwpoisoned hugepages (in which case we need to prevent the ++ * caller from accessing to them.) In order to do this, we use ++ * here is_swap_pte instead of is_hugetlb_entry_migration and ++ * is_hugetlb_entry_hwpoisoned. This is because it simply covers ++ * both cases, and because we can't follow correct pages ++ * directly from any kind of swap entries. ++ */ ++ if (absent || is_swap_pte(huge_ptep_get(pte)) || + ((flags & FOLL_WRITE) && !pte_write(huge_ptep_get(pte)))) { + int ret; + diff --git a/queue-3.8/hugetlbfs-stop-setting-vm_dontdump-in-initializing-vma-vm_hugetlb.patch b/queue-3.8/hugetlbfs-stop-setting-vm_dontdump-in-initializing-vma-vm_hugetlb.patch new file mode 100644 index 00000000000..b6e9a393f18 --- /dev/null +++ b/queue-3.8/hugetlbfs-stop-setting-vm_dontdump-in-initializing-vma-vm_hugetlb.patch @@ -0,0 +1,41 @@ +From a2fce9143057f4eb7675a21cca1b6beabe585c8b Mon Sep 17 00:00:00 2001 +From: Naoya Horiguchi +Date: Wed, 17 Apr 2013 15:58:27 -0700 +Subject: hugetlbfs: stop setting VM_DONTDUMP in initializing vma(VM_HUGETLB) + +From: Naoya Horiguchi + +commit a2fce9143057f4eb7675a21cca1b6beabe585c8b upstream. + +Currently we fail to include any data on hugepages into coredump, +because VM_DONTDUMP is set on hugetlbfs's vma. This behavior was +recently introduced by commit 314e51b9851b ("mm: kill vma flag +VM_RESERVED and mm->reserved_vm counter"). + +This looks to me a serious regression, so let's fix it. + +Signed-off-by: Naoya Horiguchi +Acked-by: Konstantin Khlebnikov +Acked-by: Michal Hocko +Reviewed-by: Rik van Riel +Acked-by: KOSAKI Motohiro +Acked-by: David Rientjes +Signed-off-by: Andrew Morton +Signed-off-by: Linus Torvalds +Signed-off-by: Greg Kroah-Hartman + +--- + fs/hugetlbfs/inode.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/fs/hugetlbfs/inode.c ++++ b/fs/hugetlbfs/inode.c +@@ -110,7 +110,7 @@ static int hugetlbfs_file_mmap(struct fi + * way when do_mmap_pgoff unwinds (may be important on powerpc + * and ia64). + */ +- vma->vm_flags |= VM_HUGETLB | VM_DONTEXPAND | VM_DONTDUMP; ++ vma->vm_flags |= VM_HUGETLB | VM_DONTEXPAND; + vma->vm_ops = &hugetlb_vm_ops; + + if (vma->vm_pgoff & (~huge_page_mask(h) >> PAGE_SHIFT)) diff --git a/queue-3.8/kernel-signal.c-stop-info-leak-via-the-tkill-and-the-tgkill-syscalls.patch b/queue-3.8/kernel-signal.c-stop-info-leak-via-the-tkill-and-the-tgkill-syscalls.patch new file mode 100644 index 00000000000..dcf7af65aa5 --- /dev/null +++ b/queue-3.8/kernel-signal.c-stop-info-leak-via-the-tkill-and-the-tgkill-syscalls.patch @@ -0,0 +1,50 @@ +From b9e146d8eb3b9ecae5086d373b50fa0c1f3e7f0f Mon Sep 17 00:00:00 2001 +From: Emese Revfy +Date: Wed, 17 Apr 2013 15:58:36 -0700 +Subject: kernel/signal.c: stop info leak via the tkill and the tgkill syscalls + +From: Emese Revfy + +commit b9e146d8eb3b9ecae5086d373b50fa0c1f3e7f0f upstream. + +This fixes a kernel memory contents leak via the tkill and tgkill syscalls +for compat processes. + +This is visible in the siginfo_t->_sifields._rt.si_sigval.sival_ptr field +when handling signals delivered from tkill. + +The place of the infoleak: + +int copy_siginfo_to_user32(compat_siginfo_t __user *to, siginfo_t *from) +{ + ... + put_user_ex(ptr_to_compat(from->si_ptr), &to->si_ptr); + ... +} + +Signed-off-by: Emese Revfy +Reviewed-by: PaX Team +Signed-off-by: Kees Cook +Cc: Al Viro +Cc: Oleg Nesterov +Cc: "Eric W. Biederman" +Cc: Serge Hallyn +Signed-off-by: Andrew Morton +Signed-off-by: Linus Torvalds +Signed-off-by: Greg Kroah-Hartman + +--- + kernel/signal.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/kernel/signal.c ++++ b/kernel/signal.c +@@ -2880,7 +2880,7 @@ do_send_specific(pid_t tgid, pid_t pid, + + static int do_tkill(pid_t tgid, pid_t pid, int sig) + { +- struct siginfo info; ++ struct siginfo info = {}; + + info.si_signo = sig; + info.si_errno = 0; diff --git a/queue-3.8/series b/queue-3.8/series index d03f952e6f8..4728e425783 100644 --- a/queue-3.8/series +++ b/queue-3.8/series @@ -5,3 +5,7 @@ kthread-prevent-unpark-race-which-puts-threads-on-the-wrong-cpu.patch hrtimer-don-t-reinitialize-a-cpu_base-lock-on-cpu_up.patch can-mcp251x-add-missing-irqf_oneshot-to-request_threaded_irq.patch can-sja1000-fix-handling-on-dt-properties-on-little-endian-systems.patch +hugetlbfs-stop-setting-vm_dontdump-in-initializing-vma-vm_hugetlb.patch +hugetlbfs-add-swap-entry-check-in-follow_hugetlb_page.patch +fs-binfmt_elf.c-fix-hugetlb-memory-check-in-vma_dump_size.patch +kernel-signal.c-stop-info-leak-via-the-tkill-and-the-tgkill-syscalls.patch -- 2.47.3