On Thu, 2012-05-10 at 19:58 +1000, Paul Mackerras wrote:
> Please include commit 90481622d7 ("hugepages: fix use after free bug
> in "quota" handling") from Linus' tree in the next 3.3 stable release.
> It applies without fuzz, though with offsets.
>
> It fixes a use-after-free bug in the huge page code that we are
> hitting when using KVM on IBM Power machines with large pages backing
> the guests, though it can in principle be hit in other ways also.
> Since it's a use-after-free bug, it tends to result in an immediate
> kernel crash if you have slab debug turned on, or occasional
> hard-to-debug memory corruption if you don't.
>
> The bug is also present in earlier kernels, and the patch should
> apply at least to 3.2. It would be good if it can be applied to
> earlier kernels also.
I tried cherry-picking this on top of 3.2.17, but there was a conflict
in unmap_ref_private(). It looks like all of these belong in 3.2.y as
well:
1e16a53 mm/hugetlb.c: fix virtual address handling in hugetlb fault
0c176d5 mm: hugetlb: fix pgoff computation when unmapping page from vma
ea5768c mm/hugetlb.c: avoid bogus counter of surplus huge page
409eb8c mm/hugetlb.c: undo change to page mapcount in fault handler
cd2934a flush_tlb_range() needs ->page_table_lock when ->mmap_sem is not held
Ben.
--
Ben Hutchings
Experience is directly proportional to the value of equipment destroyed.
- Carolyn Scheppner
Attachment:
signature.asc
Description: This is a digitally signed message part