From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Date: Tue, 18 Jul 2017 16:17:47 +0000 (+0200)
Subject: 4.4-stable patches
X-Git-Tag: v4.12.3~12
X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=995caaf0e263e831ec23b194c31c752695443c02;p=thirdparty%2Fkernel%2Fstable-queue.git

4.4-stable patches

added patches:
	mm-fix-overflow-check-in-expand_upwards.patch
---

diff --git a/queue-4.4/mm-fix-overflow-check-in-expand_upwards.patch b/queue-4.4/mm-fix-overflow-check-in-expand_upwards.patch
new file mode 100644
index 00000000000..05780c742fa
--- /dev/null
+++ b/queue-4.4/mm-fix-overflow-check-in-expand_upwards.patch
@@ -0,0 +1,49 @@
+From 37511fb5c91db93d8bd6e3f52f86e5a7ff7cfcdf Mon Sep 17 00:00:00 2001
+From: Helge Deller <deller@gmx.de>
+Date: Fri, 14 Jul 2017 14:49:38 -0700
+Subject: mm: fix overflow check in expand_upwards()
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Helge Deller <deller@gmx.de>
+
+commit 37511fb5c91db93d8bd6e3f52f86e5a7ff7cfcdf upstream.
+
+Jörn Engel noticed that the expand_upwards() function might not return
+-ENOMEM in case the requested address is (unsigned long)-PAGE_SIZE and
+if the architecture didn't defined TASK_SIZE as multiple of PAGE_SIZE.
+
+Affected architectures are arm, frv, m68k, blackfin, h8300 and xtensa
+which all define TASK_SIZE as 0xffffffff, but since none of those have
+an upwards-growing stack we currently have no actual issue.
+
+Nevertheless let's fix this just in case any of the architectures with
+an upward-growing stack (currently parisc, metag and partly ia64) define
+TASK_SIZE similar.
+
+Link: http://lkml.kernel.org/r/20170702192452.GA11868@p100.box
+Fixes: bd726c90b6b8 ("Allow stack to grow up to address space limit")
+Signed-off-by: Helge Deller <deller@gmx.de>
+Reported-by: Jörn Engel <joern@purestorage.com>
+Cc: Hugh Dickins <hughd@google.com>
+Cc: Oleg Nesterov <oleg@redhat.com>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ mm/mmap.c |    2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/mm/mmap.c
++++ b/mm/mmap.c
+@@ -2176,7 +2176,7 @@ int expand_upwards(struct vm_area_struct
+ 
+ 	/* Guard against exceeding limits of the address space. */
+ 	address &= PAGE_MASK;
+-	if (address >= TASK_SIZE)
++	if (address >= (TASK_SIZE & PAGE_MASK))
+ 		return -ENOMEM;
+ 	address += PAGE_SIZE;
+ 
diff --git a/queue-4.4/series b/queue-4.4/series
index b96fc397261..f2d899a5caf 100644
--- a/queue-4.4/series
+++ b/queue-4.4/series
@@ -40,3 +40,4 @@ tpm-get-rid-of-chip-pdev.patch
 tpm-provide-strong-locking-for-device-removal.patch
 add-shutdown-to-struct-class.patch
 tpm-issue-a-tpm2_shutdown-for-tpm2-devices.patch
+mm-fix-overflow-check-in-expand_upwards.patch