4.11-stable patches

added patches:
	kthread-fix-boot-hang-regression-on-mips-openrisc.patch

diff --git a/queue-4.11/kthread-fix-boot-hang-regression-on-mips-openrisc.patch b/queue-4.11/kthread-fix-boot-hang-regression-on-mips-openrisc.patch
new file mode 100644 (file)
index 0000000..128e55a
--- /dev/null
+++ b/queue-4.11/kthread-fix-boot-hang-regression-on-mips-openrisc.patch
@@ -0,0 +1,72 @@
+From b0f5a8f32e8bbdaae1abb8abe2d3cbafaba57e08 Mon Sep 17 00:00:00 2001
+From: Vegard Nossum <vegard.nossum@oracle.com>
+Date: Mon, 29 May 2017 09:22:07 +0200
+Subject: kthread: fix boot hang (regression) on MIPS/OpenRISC
+
+From: Vegard Nossum <vegard.nossum@oracle.com>
+
+commit b0f5a8f32e8bbdaae1abb8abe2d3cbafaba57e08 upstream.
+
+This fixes a regression in commit 4d6501dce079 where I didn't notice
+that MIPS and OpenRISC were reinitialising p->{set,clear}_child_tid to
+NULL after our initialisation in copy_process().
+
+We can simply get rid of the arch-specific initialisation here since it
+is now always done in copy_process() before hitting copy_thread{,_tls}().
+
+Review notes:
+
+ - As far as I can tell, copy_process() is the only user of
+   copy_thread_tls(), which is the only caller of copy_thread() for
+   architectures that don't implement copy_thread_tls().
+
+ - After this patch, there is no arch-specific code touching
+   p->set_child_tid or p->clear_child_tid whatsoever.
+
+ - It may look like MIPS/OpenRISC wanted to always have these fields be
+   NULL, but that's not true, as copy_process() would unconditionally
+   set them again _after_ calling copy_thread_tls() before commit
+   4d6501dce079.
+
+Fixes: 4d6501dce079c1eb6bf0b1d8f528a5e81770109e ("kthread: Fix use-after-free if kthread fork fails")
+Reported-by: Guenter Roeck <linux@roeck-us.net>
+Tested-by: Guenter Roeck <linux@roeck-us.net> # MIPS only
+Acked-by: Stafford Horne <shorne@gmail.com>
+Acked-by: Oleg Nesterov <oleg@redhat.com>
+Cc: Ralf Baechle <ralf@linux-mips.org>
+Cc: linux-mips@linux-mips.org
+Cc: Jonas Bonn <jonas@southpole.se>
+Cc: Stefan Kristiansson <stefan.kristiansson@saunalahti.fi>
+Cc: openrisc@lists.librecores.org
+Cc: Jamie Iles <jamie.iles@oracle.com>
+Cc: Thomas Gleixner <tglx@linutronix.de>
+Signed-off-by: Vegard Nossum <vegard.nossum@oracle.com>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/mips/kernel/process.c     |    1 -
+ arch/openrisc/kernel/process.c |    2 --
+ 2 files changed, 3 deletions(-)
+
+--- a/arch/mips/kernel/process.c
++++ b/arch/mips/kernel/process.c
+@@ -120,7 +120,6 @@ int copy_thread(unsigned long clone_flag
+       struct thread_info *ti = task_thread_info(p);
+       struct pt_regs *childregs, *regs = current_pt_regs();
+       unsigned long childksp;
+-      p->set_child_tid = p->clear_child_tid = NULL;
+ 
+       childksp = (unsigned long)task_stack_page(p) + THREAD_SIZE - 32;
+ 
+--- a/arch/openrisc/kernel/process.c
++++ b/arch/openrisc/kernel/process.c
+@@ -167,8 +167,6 @@ copy_thread(unsigned long clone_flags, u
+ 
+       top_of_kernel_stack = sp;
+ 
+-      p->set_child_tid = p->clear_child_tid = NULL;
+-
+       /* Locate userspace context on stack... */
+       sp -= STACK_FRAME_OVERHEAD;     /* redzone */
+       sp -= sizeof(struct pt_regs);

diff --git a/queue-4.11/series b/queue-4.11/series
index df6e1c71b42398a147937213b1fca7ac2cab33dd..b91cf9b0365fb896dd8b4d9686bab52cf6e0101a 100644 (file)
--- a/queue-4.11/series
+++ b/queue-4.11/series
@@ -148,3 +148,4 @@ audit-fix-the-rcu-locking-for-the-auditd_connection-structure.patch
 drm-i915-vbt-don-t-propagate-errors-from-intel_bios_init.patch
 drm-i915-vbt-split-out-defaults-that-are-set-when-there-is-no-vbt.patch
 netfilter-nft_set_rbtree-handle-element-re-addition-after-deletion.patch
+kthread-fix-boot-hang-regression-on-mips-openrisc.patch