lkml.org 
[lkml]   [2019]   [Nov]   [8]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
From
Subject[PATCH STABLE 4.4 0/8] page refcount overflow backports
Date
Hi,

this series backports the CVE-2019-11487 fixes (page refcount overflow) to
4.4 stable. It differs from Ajay's series [1] in the following:

- gup.c variants of fast gup for x86 and s390 are fixed too. I've not fixed
sparc, mips, sh. It's unlikely the known overflow scenario based on FUSE,
which needs 140GB of RAM, is a problem for those architectures, and I don't
feel confident enough to patch them. I've sent the same fixup for 4.9 [3]
- there are some differences in backport adaptations, hopefully not important.
My version is taken from our 4.4 based kernel, which was just simpler for me
than adding the missing parts to Ajay's version
- The last patch fixes another problem in the fast gup implementation on x86,
that I've previously posted and got merged to 4.9 stable [2].

[1] https://lore.kernel.org/linux-mm/1570581863-12090-1-git-send-email-akaher@vmware.com/
[2] https://lore.kernel.org/linux-mm/20190802160614.8089-1-vbabka@suse.cz/
[3] https://lore.kernel.org/linux-mm/9c130fa4-e52d-f8bd-c450-42341c7ab441@suse.cz/

Linus Torvalds (3):
mm: make page ref count overflow check tighter and more explicit
mm: add 'try_get_page()' helper function
mm: prevent get_user_pages() from overflowing page refcount

Matthew Wilcox (1):
fs: prevent page refcount overflow in pipe_buf_get

Miklos Szeredi (1):
pipe: add pipe_buf_get() helper

Punit Agrawal (1):
mm, gup: ensure real head page is ref-counted when using hugepages

Vlastimil Babka (1):
x86, mm, gup: prevent get_page() race with munmap in paravirt guest

Will Deacon (1):
mm, gup: remove broken VM_BUG_ON_PAGE compound check for hugepages

arch/s390/mm/gup.c | 6 +++--
arch/x86/mm/gup.c | 23 ++++++++++++++++++-
fs/fuse/dev.c | 12 +++++-----
fs/pipe.c | 4 ++--
fs/splice.c | 12 ++++++++--
include/linux/mm.h | 26 ++++++++++++++++++++-
include/linux/pipe_fs_i.h | 17 ++++++++++++--
kernel/trace/trace.c | 6 ++++-
mm/gup.c | 48 +++++++++++++++++++++++++++------------
mm/huge_memory.c | 2 +-
mm/hugetlb.c | 18 +++++++++++++--
mm/internal.h | 17 ++++++++++----
12 files changed, 152 insertions(+), 39 deletions(-)

--
2.23.0

\
 
 \ /
  Last update: 2019-11-08 10:38    [W:0.035 / U:4.468 seconds]
©2003-2018 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site