On Wed, Nov 22, 2017 at 02:58:59PM +0100, Jann Horn wrote: > commit 373c4557d2aa362702c4c2d41288fb1e54990b7c upstream. > > This matters at least for the mincore syscall, which will otherwise copy > uninitialized memory from the page allocator to userspace. It is > probably also a correctness error for /proc/$pid/pagemap, but I haven't > tested that. > > Removing the `walk->hugetlb_entry` condition in walk_hugetlb_range() has > no effect because the caller already checks for that. > > This only reports holes in hugetlb ranges to callers who have specified > a hugetlb_entry callback. > > This issue was found using an AFL-based fuzzer. > > v2: > - don't crash on ->pte_hole==NULL (Andrew Morton) > - add Cc stable (Andrew Morton) > > Changed for 4.4/4.9 stable backport: > - fix up conflict in the huge_pte_offset() call > > Fixes: 1e25a271c8ac ("mincore: apply page table walker on do_mincore()") > Signed-off-by: Jann Horn <jannh@xxxxxxxxxx> > --- > Please apply this patch to <=4.9 stable trees instead of the > original patch. Thanks for the backport! greg k-h