On Sat, 2012-05-12 at 09:34 +0100, Ben Hutchings wrote: > On Thu, 2012-05-10 at 19:58 +1000, Paul Mackerras wrote: > > Please include commit 90481622d7 ("hugepages: fix use after free bug > > in "quota" handling") from Linus' tree in the next 3.3 stable release. > > It applies without fuzz, though with offsets. > > > > It fixes a use-after-free bug in the huge page code that we are > > hitting when using KVM on IBM Power machines with large pages backing > > the guests, though it can in principle be hit in other ways also. > > Since it's a use-after-free bug, it tends to result in an immediate > > kernel crash if you have slab debug turned on, or occasional > > hard-to-debug memory corruption if you don't. > > > > The bug is also present in earlier kernels, and the patch should > > apply at least to 3.2. It would be good if it can be applied to > > earlier kernels also. > > I tried cherry-picking this on top of 3.2.17, but there was a conflict > in unmap_ref_private(). It looks like all of these belong in 3.2.y as > well: > > 1e16a53 mm/hugetlb.c: fix virtual address handling in hugetlb fault > 0c176d5 mm: hugetlb: fix pgoff computation when unmapping page from vma > ea5768c mm/hugetlb.c: avoid bogus counter of surplus huge page > 409eb8c mm/hugetlb.c: undo change to page mapcount in fault handler > cd2934a flush_tlb_range() needs ->page_table_lock when ->mmap_sem is not held Sorry, I didn't make myself clear. I'm asking for confirmation: should these all be applied to 3.2.y? Ben. -- Ben Hutchings You can't have everything. Where would you put it?
Attachment:
signature.asc
Description: This is a digitally signed message part