From: Greg Kroah-Hartman Date: Tue, 13 Jun 2017 07:22:36 +0000 (+0200) Subject: 4.11-stable patches X-Git-Tag: v3.18.57~2 X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=3b1b045eb359e2354012a7cf3e43e0eef7f26e56;p=thirdparty%2Fkernel%2Fstable-queue.git 4.11-stable patches added patches: kthread-fix-boot-hang-regression-on-mips-openrisc.patch --- diff --git a/queue-4.11/kthread-fix-boot-hang-regression-on-mips-openrisc.patch b/queue-4.11/kthread-fix-boot-hang-regression-on-mips-openrisc.patch new file mode 100644 index 00000000000..128e55af31b --- /dev/null +++ b/queue-4.11/kthread-fix-boot-hang-regression-on-mips-openrisc.patch @@ -0,0 +1,72 @@ +From b0f5a8f32e8bbdaae1abb8abe2d3cbafaba57e08 Mon Sep 17 00:00:00 2001 +From: Vegard Nossum +Date: Mon, 29 May 2017 09:22:07 +0200 +Subject: kthread: fix boot hang (regression) on MIPS/OpenRISC + +From: Vegard Nossum + +commit b0f5a8f32e8bbdaae1abb8abe2d3cbafaba57e08 upstream. + +This fixes a regression in commit 4d6501dce079 where I didn't notice +that MIPS and OpenRISC were reinitialising p->{set,clear}_child_tid to +NULL after our initialisation in copy_process(). + +We can simply get rid of the arch-specific initialisation here since it +is now always done in copy_process() before hitting copy_thread{,_tls}(). + +Review notes: + + - As far as I can tell, copy_process() is the only user of + copy_thread_tls(), which is the only caller of copy_thread() for + architectures that don't implement copy_thread_tls(). + + - After this patch, there is no arch-specific code touching + p->set_child_tid or p->clear_child_tid whatsoever. + + - It may look like MIPS/OpenRISC wanted to always have these fields be + NULL, but that's not true, as copy_process() would unconditionally + set them again _after_ calling copy_thread_tls() before commit + 4d6501dce079. + +Fixes: 4d6501dce079c1eb6bf0b1d8f528a5e81770109e ("kthread: Fix use-after-free if kthread fork fails") +Reported-by: Guenter Roeck +Tested-by: Guenter Roeck # MIPS only +Acked-by: Stafford Horne +Acked-by: Oleg Nesterov +Cc: Ralf Baechle +Cc: linux-mips@linux-mips.org +Cc: Jonas Bonn +Cc: Stefan Kristiansson +Cc: openrisc@lists.librecores.org +Cc: Jamie Iles +Cc: Thomas Gleixner +Signed-off-by: Vegard Nossum +Signed-off-by: Linus Torvalds +Signed-off-by: Greg Kroah-Hartman + +--- + arch/mips/kernel/process.c | 1 - + arch/openrisc/kernel/process.c | 2 -- + 2 files changed, 3 deletions(-) + +--- a/arch/mips/kernel/process.c ++++ b/arch/mips/kernel/process.c +@@ -120,7 +120,6 @@ int copy_thread(unsigned long clone_flag + struct thread_info *ti = task_thread_info(p); + struct pt_regs *childregs, *regs = current_pt_regs(); + unsigned long childksp; +- p->set_child_tid = p->clear_child_tid = NULL; + + childksp = (unsigned long)task_stack_page(p) + THREAD_SIZE - 32; + +--- a/arch/openrisc/kernel/process.c ++++ b/arch/openrisc/kernel/process.c +@@ -167,8 +167,6 @@ copy_thread(unsigned long clone_flags, u + + top_of_kernel_stack = sp; + +- p->set_child_tid = p->clear_child_tid = NULL; +- + /* Locate userspace context on stack... */ + sp -= STACK_FRAME_OVERHEAD; /* redzone */ + sp -= sizeof(struct pt_regs); diff --git a/queue-4.11/series b/queue-4.11/series index df6e1c71b42..b91cf9b0365 100644 --- a/queue-4.11/series +++ b/queue-4.11/series @@ -148,3 +148,4 @@ audit-fix-the-rcu-locking-for-the-auditd_connection-structure.patch drm-i915-vbt-don-t-propagate-errors-from-intel_bios_init.patch drm-i915-vbt-split-out-defaults-that-are-set-when-there-is-no-vbt.patch netfilter-nft_set_rbtree-handle-element-re-addition-after-deletion.patch +kthread-fix-boot-hang-regression-on-mips-openrisc.patch