From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1754197AbdGCPiO (ORCPT ); Mon, 3 Jul 2017 11:38:14 -0400 Received: from shadbolt.e.decadent.org.uk ([88.96.1.126]:50779 "EHLO shadbolt.e.decadent.org.uk" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1752222AbdGCPiH (ORCPT ); Mon, 3 Jul 2017 11:38:07 -0400 Message-ID: <1499096278.2707.15.camel@decadent.org.uk> Subject: Linux 3.16.45 From: Ben Hutchings To: linux-kernel@vger.kernel.org, Andrew Morton , torvalds@linux-foundation.org, Jiri Slaby , stable@vger.kernel.org Cc: lwn@lwn.net Date: Mon, 03 Jul 2017 16:37:58 +0100 Content-Type: multipart/signed; micalg="pgp-sha512"; protocol="application/pgp-signature"; boundary="=-SO4gYKpFKkHHJamZraaY" X-Mailer: Evolution 3.22.6-1 Mime-Version: 1.0 X-SA-Exim-Connect-IP: 82.70.136.246 X-SA-Exim-Mail-From: ben@decadent.org.uk X-SA-Exim-Scanned: No (on shadbolt.decadent.org.uk); SAEximRunCond expanded to false Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org --=-SO4gYKpFKkHHJamZraaY Content-Type: multipart/mixed; boundary="=-ft4PniS/RVXbNQHpcsmr" --=-ft4PniS/RVXbNQHpcsmr Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: base64 SSdtIGFubm91bmNpbmcgdGhlIHJlbGVhc2Ugb2YgdGhlIDMuMTYuNDUga2VybmVsLgoKQWxsIHVz ZXJzIG9mIHRoZSAzLjE2IGtlcm5lbCBzZXJpZXMgc2hvdWxkIHVwZ3JhZGUuCgpUaGUgdXBkYXRl ZCAzLjE2LnkgZ2l0IHRyZWUgY2FuIGJlIGZvdW5kIGF0OgrCoMKgwqDCoMKgwqDCoMKgaHR0cHM6 Ly9naXQua2VybmVsLm9yZy9wdWIvc2NtL2xpbnV4L2tlcm5lbC9naXQvc3RhYmxlL2xpbnV4LXN0 YWJsZS5naXQgbGludXgtMy4xNi55CmFuZCBjYW4gYmUgYnJvd3NlZCBhdCB0aGUgbm9ybWFsIGtl cm5lbC5vcmcgZ2l0IHdlYiBicm93c2VyOgrCoMKgwqDCoMKgwqDCoMKgaHR0cHM6Ly9naXQua2Vy bmVsLm9yZy8/cD1saW51eC9rZXJuZWwvZ2l0L3N0YWJsZS9saW51eC1zdGFibGUuZ2l0CgpUaGUg ZGlmZiBmcm9tIDMuMTYuNDQgaXMgYXR0YWNoZWQgdG8gdGhpcyBtZXNzYWdlLgoKQmVuLgoKLS0t LS0tLS0tLS0tCgrCoERvY3VtZW50YXRpb24va2VybmVsLXBhcmFtZXRlcnMudHh0wqDCoMKgwqDC oHzCoMKgwqA3ICsrCsKgTWFrZWZpbGXCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKg wqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgfMKgwqDCoDIgKy0KwqBhcmNoL2FyYy9tbS9t bWFwLmPCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoHzCoMKgwqAy ICstCsKgYXJjaC9hcm0vbW0vbW1hcC5jwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDC oMKgwqDCoMKgwqB8wqDCoMKgNCArLQrCoGFyY2gvZnJ2L21tL2VsZi1mZHBpYy5jwqDCoMKgwqDC oMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoHzCoMKgwqAyICstCsKgYXJjaC9taXBzL21tL21tYXAu Y8KgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoHzCoMKgwqAyICstCsKg YXJjaC9wYXJpc2Mva2VybmVsL3N5c19wYXJpc2MuY8KgwqDCoMKgwqDCoMKgwqDCoHzCoMKgMTUg Ky0tCsKgYXJjaC9wb3dlcnBjL21tL3NsaWNlLmPCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKg wqDCoMKgfMKgwqDCoDIgKy0KwqBhcmNoL3NoL21tL21tYXAuY8KgwqDCoMKgwqDCoMKgwqDCoMKg wqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqB8wqDCoMKgNCArLQrCoGFyY2gvc3BhcmMva2VybmVs L3N5c19zcGFyY182NC5jwqDCoMKgwqDCoMKgwqDCoHzCoMKgwqA0ICstCsKgYXJjaC9zcGFyYy9t bS9odWdldGxicGFnZS5jwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqB8wqDCoMKgMiArLQrCoGFy Y2gvdGlsZS9tbS9odWdldGxicGFnZS5jwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoHzCoMKg wqAyICstCsKgYXJjaC94ODYvaW5jbHVkZS9hc20va3ZtX2VtdWxhdGUuaMKgwqDCoMKgwqDCoHzC oMKgwqAxICsKwqBhcmNoL3g4Ni9rZXJuZWwvc3lzX3g4Nl82NC5jwqDCoMKgwqDCoMKgwqDCoMKg wqDCoMKgfMKgwqDCoDQgKy0KwqBhcmNoL3g4Ni9rdm0vZW11bGF0ZS5jwqDCoMKgwqDCoMKgwqDC oMKgwqDCoMKgwqDCoMKgwqDCoMKgfMKgwqDCoDEgKwrCoGFyY2gveDg2L2t2bS94ODYuY8KgwqDC oMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgfMKgwqA1MyArKysrKy0tLS0t LQrCoGFyY2gveDg2L21tL2h1Z2V0bGJwYWdlLmPCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKg wqB8wqDCoMKgMiArLQrCoGFyY2gveHRlbnNhL2tlcm5lbC9zeXNjYWxsLmPCoMKgwqDCoMKgwqDC oMKgwqDCoMKgwqB8wqDCoMKgMiArLQrCoGRyaXZlcnMvZ3B1L2RybS92bXdnZngvdm13Z2Z4X3N1 cmZhY2UuYyB8wqDCoMKgMyArCsKgZHJpdmVycy9yZWd1bGF0b3IvY29yZS5jwqDCoMKgwqDCoMKg wqDCoMKgwqDCoMKgwqDCoMKgwqB8wqDCoMKgMiArCsKgZnMvaHVnZXRsYmZzL2lub2RlLmPCoMKg wqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgfMKgwqDCoDIgKy0KwqBmcy9wcm9j L3Rhc2tfbW11LmPCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoHzC oMKgwqA0IC0KwqBpbmNsdWRlL2xpbnV4L21tLmjCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKg wqDCoMKgwqDCoMKgwqDCoHzCoMKgNTMgKysrKystLS0tLS0KwqBtbS9ndXAuY8KgwqDCoMKgwqDC oMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqB8wqDC oMKgNSAtCsKgbW0vbWVtb3J5LmPCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDC oMKgwqDCoMKgwqDCoMKgwqDCoMKgfMKgwqAzOCAtLS0tLS0tLQrCoG1tL21tYXAuY8KgwqDCoMKg wqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgfCAx NjAgKysrKysrKysrKysrKysrKysrKy0tLS0tLS0tLS0tLS0KwqBuZXQvcnhycGMvYXIta2V5LmPC oMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoMKgwqDCoHzCoMKgNjQgKysrKysr Ky0tLS0tLQrCoDI3IGZpbGVzIGNoYW5nZWQsIDIxOSBpbnNlcnRpb25zKCspLCAyMjMgZGVsZXRp b25zKC0pCgpCZW4gSHV0Y2hpbmdzICgxKToKwqDCoMKgwqDCoMKgTGludXggMy4xNi40NQoKRGF2 aWQgSG93ZWxscyAoMSk6CsKgwqDCoMKgwqDCoHJ4cnBjOiBGaXggc2V2ZXJhbCBjYXNlcyB3aGVy ZSBhIHBhZGRlZCBsZW4gaXNuJ3QgY2hlY2tlZCBpbiB0aWNrZXQgZGVjb2RlCgpIZWxnZSBEZWxs ZXIgKDEpOgrCoMKgwqDCoMKgwqBBbGxvdyBzdGFjayB0byBncm93IHVwIHRvIGFkZHJlc3Mgc3Bh Y2UgbGltaXQKCkh1Z2ggRGlja2lucyAoMik6CsKgwqDCoMKgwqDCoG1tOiBsYXJnZXIgc3RhY2sg Z3VhcmQgZ2FwLCBiZXR3ZWVuIHZtYXMKwqDCoMKgwqDCoMKgbW06IGZpeCBuZXcgY3Jhc2ggaW4g dW5tYXBwZWRfYXJlYV90b3Bkb3duKCkKClBhb2xvIEJvbnppbmkgKDEpOgrCoMKgwqDCoMKgwqBL Vk06IHg4NjogZml4IHNpbmdsZXN0ZXBwaW5nIG92ZXIgc3lzY2FsbAoKU2V1bmctV29vIEtpbSAo MSk6CsKgwqDCoMKgwqDCoHJlZ3VsYXRvcjogY29yZTogRml4IHJlZ3VhbHRvcl9lbmFfZ3Bpb19m cmVlIG5vdCB0byBhY2Nlc3MgcGluIGFmdGVyIGZyZWVpbmcKClZsYWRpcyBEcm9ub3YgKDEpOgrC oMKgwqDCoMKgwqBkcm0vdm13Z2Z4OiBsaW1pdCB0aGUgbnVtYmVyIG9mIG1pcCBsZXZlbHMgaW4g dm13X2diX3N1cmZhY2VfZGVmaW5lX2lvY3RsKCkKCi0tIApCZW4gSHV0Y2hpbmdzCkxhcmtpbnNv bidzIExhdzogQWxsIGxhd3MgYXJlIGJhc2ljYWxseSBmYWxzZS4KCg== --=-ft4PniS/RVXbNQHpcsmr Content-Type: text/x-diff; charset="UTF-8"; name="linux-3.16.45.patch" Content-Disposition: attachment; filename="linux-3.16.45.patch" Content-Transfer-Encoding: quoted-printable diff --git a/Documentation/kernel-parameters.txt b/Documentation/kernel-par= ameters.txt index cb76a3cf0763..86c91be8647c 100644 --- a/Documentation/kernel-parameters.txt +++ b/Documentation/kernel-parameters.txt @@ -3154,6 +3154,13 @@ bytes respectively. Such letter suffixes can also be= entirely omitted. spia_pedr=3D spia_peddr=3D =20 + stack_guard_gap=3D [MM] + override the default stack gap protection. The value + is in page units and it defines how many pages prior + to (for stacks growing down) resp. after (for stacks + growing up) the main stack are reserved for no other + mapping. Default value is 256 pages. + stacktrace [FTRACE] Enabled the stack tracer on boot up. =20 diff --git a/Makefile b/Makefile index 1680e3f85a06..6effa4401a09 100644 --- a/Makefile +++ b/Makefile @@ -1,6 +1,6 @@ VERSION =3D 3 PATCHLEVEL =3D 16 -SUBLEVEL =3D 44 +SUBLEVEL =3D 45 EXTRAVERSION =3D NAME =3D Museum of Fishiegoodies =20 diff --git a/arch/arc/mm/mmap.c b/arch/arc/mm/mmap.c index 2e06d56e987b..cf4ae6958240 100644 --- a/arch/arc/mm/mmap.c +++ b/arch/arc/mm/mmap.c @@ -64,7 +64,7 @@ arch_get_unmapped_area(struct file *filp, unsigned long a= ddr, =20 vma =3D find_vma(mm, addr); if (TASK_SIZE - len >=3D addr && - (!vma || addr + len <=3D vma->vm_start)) + (!vma || addr + len <=3D vm_start_gap(vma))) return addr; } =20 diff --git a/arch/arm/mm/mmap.c b/arch/arm/mm/mmap.c index 5e85ed371364..8f9d1cf505dd 100644 --- a/arch/arm/mm/mmap.c +++ b/arch/arm/mm/mmap.c @@ -89,7 +89,7 @@ arch_get_unmapped_area(struct file *filp, unsigned long a= ddr, =20 vma =3D find_vma(mm, addr); if (TASK_SIZE - len >=3D addr && - (!vma || addr + len <=3D vma->vm_start)) + (!vma || addr + len <=3D vm_start_gap(vma))) return addr; } =20 @@ -140,7 +140,7 @@ arch_get_unmapped_area_topdown(struct file *filp, const= unsigned long addr0, addr =3D PAGE_ALIGN(addr); vma =3D find_vma(mm, addr); if (TASK_SIZE - len >=3D addr && - (!vma || addr + len <=3D vma->vm_start)) + (!vma || addr + len <=3D vm_start_gap(vma))) return addr; } =20 diff --git a/arch/frv/mm/elf-fdpic.c b/arch/frv/mm/elf-fdpic.c index 836f14707a62..efa59f1f8022 100644 --- a/arch/frv/mm/elf-fdpic.c +++ b/arch/frv/mm/elf-fdpic.c @@ -74,7 +74,7 @@ unsigned long arch_get_unmapped_area(struct file *filp, u= nsigned long addr, unsi addr =3D PAGE_ALIGN(addr); vma =3D find_vma(current->mm, addr); if (TASK_SIZE - len >=3D addr && - (!vma || addr + len <=3D vma->vm_start)) + (!vma || addr + len <=3D vm_start_gap(vma))) goto success; } =20 diff --git a/arch/mips/mm/mmap.c b/arch/mips/mm/mmap.c index f1baadd56e82..9be924f08f34 100644 --- a/arch/mips/mm/mmap.c +++ b/arch/mips/mm/mmap.c @@ -92,7 +92,7 @@ static unsigned long arch_get_unmapped_area_common(struct= file *filp, =20 vma =3D find_vma(mm, addr); if (TASK_SIZE - len >=3D addr && - (!vma || addr + len <=3D vma->vm_start)) + (!vma || addr + len <=3D vm_start_gap(vma))) return addr; } =20 diff --git a/arch/parisc/kernel/sys_parisc.c b/arch/parisc/kernel/sys_paris= c.c index 5aba01ac457f..4dda73c44fee 100644 --- a/arch/parisc/kernel/sys_parisc.c +++ b/arch/parisc/kernel/sys_parisc.c @@ -88,7 +88,7 @@ unsigned long arch_get_unmapped_area(struct file *filp, u= nsigned long addr, unsigned long len, unsigned long pgoff, unsigned long flags) { struct mm_struct *mm =3D current->mm; - struct vm_area_struct *vma; + struct vm_area_struct *vma, *prev; unsigned long task_size =3D TASK_SIZE; int do_color_align, last_mmap; struct vm_unmapped_area_info info; @@ -115,9 +115,10 @@ unsigned long arch_get_unmapped_area(struct file *filp= , unsigned long addr, else addr =3D PAGE_ALIGN(addr); =20 - vma =3D find_vma(mm, addr); + vma =3D find_vma_prev(mm, addr, &prev); if (task_size - len >=3D addr && - (!vma || addr + len <=3D vma->vm_start)) + (!vma || addr + len <=3D vm_start_gap(vma)) && + (!prev || addr >=3D vm_end_gap(prev))) goto found_addr; } =20 @@ -141,7 +142,7 @@ arch_get_unmapped_area_topdown(struct file *filp, const= unsigned long addr0, const unsigned long len, const unsigned long pgoff, const unsigned long flags) { - struct vm_area_struct *vma; + struct vm_area_struct *vma, *prev; struct mm_struct *mm =3D current->mm; unsigned long addr =3D addr0; int do_color_align, last_mmap; @@ -175,9 +176,11 @@ arch_get_unmapped_area_topdown(struct file *filp, cons= t unsigned long addr0, addr =3D COLOR_ALIGN(addr, last_mmap, pgoff); else addr =3D PAGE_ALIGN(addr); - vma =3D find_vma(mm, addr); + + vma =3D find_vma_prev(mm, addr, &prev); if (TASK_SIZE - len >=3D addr && - (!vma || addr + len <=3D vma->vm_start)) + (!vma || addr + len <=3D vm_start_gap(vma)) && + (!prev || addr >=3D vm_end_gap(prev))) goto found_addr; } =20 diff --git a/arch/powerpc/mm/slice.c b/arch/powerpc/mm/slice.c index b0c75cc15efc..7477de0e6e3c 100644 --- a/arch/powerpc/mm/slice.c +++ b/arch/powerpc/mm/slice.c @@ -103,7 +103,7 @@ static int slice_area_is_free(struct mm_struct *mm, uns= igned long addr, if ((mm->task_size - len) < addr) return 0; vma =3D find_vma(mm, addr); - return (!vma || (addr + len) <=3D vma->vm_start); + return (!vma || (addr + len) <=3D vm_start_gap(vma)); } =20 static int slice_low_has_vma(struct mm_struct *mm, unsigned long slice) diff --git a/arch/sh/mm/mmap.c b/arch/sh/mm/mmap.c index 6777177807c2..7df7d5944188 100644 --- a/arch/sh/mm/mmap.c +++ b/arch/sh/mm/mmap.c @@ -63,7 +63,7 @@ unsigned long arch_get_unmapped_area(struct file *filp, u= nsigned long addr, =20 vma =3D find_vma(mm, addr); if (TASK_SIZE - len >=3D addr && - (!vma || addr + len <=3D vma->vm_start)) + (!vma || addr + len <=3D vm_start_gap(vma))) return addr; } =20 @@ -113,7 +113,7 @@ arch_get_unmapped_area_topdown(struct file *filp, const= unsigned long addr0, =20 vma =3D find_vma(mm, addr); if (TASK_SIZE - len >=3D addr && - (!vma || addr + len <=3D vma->vm_start)) + (!vma || addr + len <=3D vm_start_gap(vma))) return addr; } =20 diff --git a/arch/sparc/kernel/sys_sparc_64.c b/arch/sparc/kernel/sys_sparc= _64.c index c690c8e16a96..7f0f7c01b297 100644 --- a/arch/sparc/kernel/sys_sparc_64.c +++ b/arch/sparc/kernel/sys_sparc_64.c @@ -118,7 +118,7 @@ unsigned long arch_get_unmapped_area(struct file *filp,= unsigned long addr, unsi =20 vma =3D find_vma(mm, addr); if (task_size - len >=3D addr && - (!vma || addr + len <=3D vma->vm_start)) + (!vma || addr + len <=3D vm_start_gap(vma))) return addr; } =20 @@ -181,7 +181,7 @@ arch_get_unmapped_area_topdown(struct file *filp, const= unsigned long addr0, =20 vma =3D find_vma(mm, addr); if (task_size - len >=3D addr && - (!vma || addr + len <=3D vma->vm_start)) + (!vma || addr + len <=3D vm_start_gap(vma))) return addr; } =20 diff --git a/arch/sparc/mm/hugetlbpage.c b/arch/sparc/mm/hugetlbpage.c index d329537739c6..15034695b839 100644 --- a/arch/sparc/mm/hugetlbpage.c +++ b/arch/sparc/mm/hugetlbpage.c @@ -115,7 +115,7 @@ hugetlb_get_unmapped_area(struct file *file, unsigned l= ong addr, addr =3D ALIGN(addr, HPAGE_SIZE); vma =3D find_vma(mm, addr); if (task_size - len >=3D addr && - (!vma || addr + len <=3D vma->vm_start)) + (!vma || addr + len <=3D vm_start_gap(vma))) return addr; } if (mm->get_unmapped_area =3D=3D arch_get_unmapped_area) diff --git a/arch/tile/mm/hugetlbpage.c b/arch/tile/mm/hugetlbpage.c index e514899e1100..94c240634fc6 100644 --- a/arch/tile/mm/hugetlbpage.c +++ b/arch/tile/mm/hugetlbpage.c @@ -265,7 +265,7 @@ unsigned long hugetlb_get_unmapped_area(struct file *fi= le, unsigned long addr, addr =3D ALIGN(addr, huge_page_size(h)); vma =3D find_vma(mm, addr); if (TASK_SIZE - len >=3D addr && - (!vma || addr + len <=3D vma->vm_start)) + (!vma || addr + len <=3D vm_start_gap(vma))) return addr; } if (current->mm->get_unmapped_area =3D=3D arch_get_unmapped_area) diff --git a/arch/x86/include/asm/kvm_emulate.h b/arch/x86/include/asm/kvm_= emulate.h index a04fe4eb237d..c10f7175bef3 100644 --- a/arch/x86/include/asm/kvm_emulate.h +++ b/arch/x86/include/asm/kvm_emulate.h @@ -274,6 +274,7 @@ struct x86_emulate_ctxt { bool guest_mode; /* guest running a nested guest */ bool perm_ok; /* do not check permissions if true */ bool ud; /* inject an #UD if host doesn't support insn */ + bool tf; /* TF value before instruction (after for syscall/sysret) */ =20 bool have_exception; struct x86_exception exception; diff --git a/arch/x86/kernel/sys_x86_64.c b/arch/x86/kernel/sys_x86_64.c index 30277e27431a..d050393d3be2 100644 --- a/arch/x86/kernel/sys_x86_64.c +++ b/arch/x86/kernel/sys_x86_64.c @@ -127,7 +127,7 @@ arch_get_unmapped_area(struct file *filp, unsigned long= addr, addr =3D PAGE_ALIGN(addr); vma =3D find_vma(mm, addr); if (end - len >=3D addr && - (!vma || addr + len <=3D vma->vm_start)) + (!vma || addr + len <=3D vm_start_gap(vma))) return addr; } =20 @@ -166,7 +166,7 @@ arch_get_unmapped_area_topdown(struct file *filp, const= unsigned long addr0, addr =3D PAGE_ALIGN(addr); vma =3D find_vma(mm, addr); if (TASK_SIZE - len >=3D addr && - (!vma || addr + len <=3D vma->vm_start)) + (!vma || addr + len <=3D vm_start_gap(vma))) return addr; } =20 diff --git a/arch/x86/kvm/emulate.c b/arch/x86/kvm/emulate.c index 35f8884817fa..3ef118df2547 100644 --- a/arch/x86/kvm/emulate.c +++ b/arch/x86/kvm/emulate.c @@ -2310,6 +2310,7 @@ static int em_syscall(struct x86_emulate_ctxt *ctxt) ctxt->eflags &=3D ~(EFLG_VM | EFLG_IF | EFLG_RF); } =20 + ctxt->tf =3D (ctxt->eflags & X86_EFLAGS_TF) !=3D 0; return X86EMUL_CONTINUE; } =20 diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c index 7dcb958a8054..75bf438eb2e5 100644 --- a/arch/x86/kvm/x86.c +++ b/arch/x86/kvm/x86.c @@ -4942,6 +4942,8 @@ static void init_emulate_ctxt(struct kvm_vcpu *vcpu) kvm_x86_ops->get_cs_db_l_bits(vcpu, &cs_db, &cs_l); =20 ctxt->eflags =3D kvm_get_rflags(vcpu); + ctxt->tf =3D (ctxt->eflags & X86_EFLAGS_TF) !=3D 0; + ctxt->eip =3D kvm_rip_read(vcpu); ctxt->mode =3D (!is_protmode(vcpu)) ? X86EMUL_MODE_REAL : (ctxt->eflags & X86_EFLAGS_VM) ? X86EMUL_MODE_VM86 : @@ -5132,38 +5134,26 @@ static int kvm_vcpu_check_hw_bp(unsigned long addr,= u32 type, u32 dr7, return dr6; } =20 -static void kvm_vcpu_check_singlestep(struct kvm_vcpu *vcpu, int *r) +static void kvm_vcpu_do_singlestep(struct kvm_vcpu *vcpu, int *r) { struct kvm_run *kvm_run =3D vcpu->run; =20 - /* - * Use the "raw" value to see if TF was passed to the processor. - * Note that the new value of the flags has not been saved yet. - * - * This is correct even for TF set by the guest, because "the - * processor will not generate this exception after the instruction - * that sets the TF flag". - */ - unsigned long rflags =3D kvm_x86_ops->get_rflags(vcpu); - - if (unlikely(rflags & X86_EFLAGS_TF)) { - if (vcpu->guest_debug & KVM_GUESTDBG_SINGLESTEP) { - kvm_run->debug.arch.dr6 =3D DR6_BS | DR6_FIXED_1; - kvm_run->debug.arch.pc =3D vcpu->arch.singlestep_rip; - kvm_run->debug.arch.exception =3D DB_VECTOR; - kvm_run->exit_reason =3D KVM_EXIT_DEBUG; - *r =3D EMULATE_USER_EXIT; - } else { - vcpu->arch.emulate_ctxt.eflags &=3D ~X86_EFLAGS_TF; - /* - * "Certain debug exceptions may clear bit 0-3. The - * remaining contents of the DR6 register are never - * cleared by the processor". - */ - vcpu->arch.dr6 &=3D ~15; - vcpu->arch.dr6 |=3D DR6_BS; - kvm_queue_exception(vcpu, DB_VECTOR); - } + if (vcpu->guest_debug & KVM_GUESTDBG_SINGLESTEP) { + kvm_run->debug.arch.dr6 =3D DR6_BS | DR6_FIXED_1; + kvm_run->debug.arch.pc =3D vcpu->arch.singlestep_rip; + kvm_run->debug.arch.exception =3D DB_VECTOR; + kvm_run->exit_reason =3D KVM_EXIT_DEBUG; + *r =3D EMULATE_USER_EXIT; + } else { + vcpu->arch.emulate_ctxt.eflags &=3D ~X86_EFLAGS_TF; + /* + * "Certain debug exceptions may clear bit 0-3. The + * remaining contents of the DR6 register are never + * cleared by the processor". + */ + vcpu->arch.dr6 &=3D ~15; + vcpu->arch.dr6 |=3D DR6_BS; + kvm_queue_exception(vcpu, DB_VECTOR); } } =20 @@ -5316,8 +5306,9 @@ int x86_emulate_instruction(struct kvm_vcpu *vcpu, kvm_make_request(KVM_REQ_EVENT, vcpu); vcpu->arch.emulate_regs_need_sync_to_vcpu =3D false; kvm_rip_write(vcpu, ctxt->eip); - if (r =3D=3D EMULATE_DONE) - kvm_vcpu_check_singlestep(vcpu, &r); + if (r =3D=3D EMULATE_DONE && + (ctxt->tf || (vcpu->guest_debug & KVM_GUESTDBG_SINGLESTEP))) + kvm_vcpu_do_singlestep(vcpu, &r); kvm_set_rflags(vcpu, ctxt->eflags); } else vcpu->arch.emulate_regs_need_sync_to_vcpu =3D true; diff --git a/arch/x86/mm/hugetlbpage.c b/arch/x86/mm/hugetlbpage.c index 006cc914994b..fd277c4dd2e0 100644 --- a/arch/x86/mm/hugetlbpage.c +++ b/arch/x86/mm/hugetlbpage.c @@ -156,7 +156,7 @@ hugetlb_get_unmapped_area(struct file *file, unsigned l= ong addr, addr =3D ALIGN(addr, huge_page_size(h)); vma =3D find_vma(mm, addr); if (TASK_SIZE - len >=3D addr && - (!vma || addr + len <=3D vma->vm_start)) + (!vma || addr + len <=3D vm_start_gap(vma))) return addr; } if (mm->get_unmapped_area =3D=3D arch_get_unmapped_area) diff --git a/arch/xtensa/kernel/syscall.c b/arch/xtensa/kernel/syscall.c index 5d3f7a119ed1..1ff0b92eeae7 100644 --- a/arch/xtensa/kernel/syscall.c +++ b/arch/xtensa/kernel/syscall.c @@ -86,7 +86,7 @@ unsigned long arch_get_unmapped_area(struct file *filp, u= nsigned long addr, /* At this point: (!vmm || addr < vmm->vm_end). */ if (TASK_SIZE - len < addr) return -ENOMEM; - if (!vmm || addr + len <=3D vmm->vm_start) + if (!vmm || addr + len <=3D vm_start_gap(vmm)) return addr; addr =3D vmm->vm_end; if (flags & MAP_SHARED) diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_surface.c b/drivers/gpu/drm/vmwg= fx/vmwgfx_surface.c index 67623797bd55..14551e27814c 100644 --- a/drivers/gpu/drm/vmwgfx/vmwgfx_surface.c +++ b/drivers/gpu/drm/vmwgfx/vmwgfx_surface.c @@ -1251,6 +1251,9 @@ int vmw_gb_surface_define_ioctl(struct drm_device *de= v, void *data, const struct svga3d_surface_desc *desc; uint32_t backup_handle; =20 + if (req->mip_levels > DRM_VMW_MAX_MIP_LEVELS) + return -EINVAL; + if (unlikely(vmw_user_surface_size =3D=3D 0)) vmw_user_surface_size =3D ttm_round_pot(sizeof(*user_srf)) + 128; diff --git a/drivers/regulator/core.c b/drivers/regulator/core.c index a2e836478549..71fb2037e0b9 100644 --- a/drivers/regulator/core.c +++ b/drivers/regulator/core.c @@ -1709,6 +1709,8 @@ static void regulator_ena_gpio_free(struct regulator_= dev *rdev) gpio_free(pin->gpio); list_del(&pin->list); kfree(pin); + rdev->ena_pin =3D NULL; + return; } else { pin->request_count--; } diff --git a/fs/hugetlbfs/inode.c b/fs/hugetlbfs/inode.c index e3ac491424fc..3a4af9d401c3 100644 --- a/fs/hugetlbfs/inode.c +++ b/fs/hugetlbfs/inode.c @@ -171,7 +171,7 @@ hugetlb_get_unmapped_area(struct file *file, unsigned l= ong addr, addr =3D ALIGN(addr, huge_page_size(h)); vma =3D find_vma(mm, addr); if (TASK_SIZE - len >=3D addr && - (!vma || addr + len <=3D vma->vm_start)) + (!vma || addr + len <=3D vm_start_gap(vma))) return addr; } =20 diff --git a/fs/proc/task_mmu.c b/fs/proc/task_mmu.c index 5825f6d944ce..fb073b9fe25e 100644 --- a/fs/proc/task_mmu.c +++ b/fs/proc/task_mmu.c @@ -273,11 +273,7 @@ show_map_vma(struct seq_file *m, struct vm_area_struct= *vma, int is_pid) =20 /* We don't show the stack guard page in /proc/maps */ start =3D vma->vm_start; - if (stack_guard_page_start(vma, start)) - start +=3D PAGE_SIZE; end =3D vma->vm_end; - if (stack_guard_page_end(vma, end)) - end -=3D PAGE_SIZE; =20 seq_setwidth(m, 25 + sizeof(void *) * 6 - 1); seq_printf(m, "%08lx-%08lx %c%c%c%c %08llx %02x:%02x %lu ", diff --git a/include/linux/mm.h b/include/linux/mm.h index e648c24e8410..35f8b59b37a7 100644 --- a/include/linux/mm.h +++ b/include/linux/mm.h @@ -1241,34 +1241,6 @@ int set_page_dirty_lock(struct page *page); int clear_page_dirty_for_io(struct page *page); int get_cmdline(struct task_struct *task, char *buffer, int buflen); =20 -/* Is the vma a continuation of the stack vma above it? */ -static inline int vma_growsdown(struct vm_area_struct *vma, unsigned long = addr) -{ - return vma && (vma->vm_end =3D=3D addr) && (vma->vm_flags & VM_GROWSDOWN)= ; -} - -static inline int stack_guard_page_start(struct vm_area_struct *vma, - unsigned long addr) -{ - return (vma->vm_flags & VM_GROWSDOWN) && - (vma->vm_start =3D=3D addr) && - !vma_growsdown(vma->vm_prev, addr); -} - -/* Is the vma a continuation of the stack vma below it? */ -static inline int vma_growsup(struct vm_area_struct *vma, unsigned long ad= dr) -{ - return vma && (vma->vm_start =3D=3D addr) && (vma->vm_flags & VM_GROWSUP)= ; -} - -static inline int stack_guard_page_end(struct vm_area_struct *vma, - unsigned long addr) -{ - return (vma->vm_flags & VM_GROWSUP) && - (vma->vm_end =3D=3D addr) && - !vma_growsup(vma->vm_next, addr); -} - extern pid_t vm_is_stack(struct task_struct *task, struct vm_area_struct *vma, int in_g= roup); =20 @@ -1914,6 +1886,7 @@ void page_cache_async_readahead(struct address_space = *mapping, =20 unsigned long max_sane_readahead(unsigned long nr); =20 +extern unsigned long stack_guard_gap; /* Generic expand stack which grows the stack according to GROWS{UP,DOWN} = */ extern int expand_stack(struct vm_area_struct *vma, unsigned long address)= ; =20 @@ -1942,6 +1915,30 @@ static inline struct vm_area_struct * find_vma_inter= section(struct mm_struct * m return vma; } =20 +static inline unsigned long vm_start_gap(struct vm_area_struct *vma) +{ + unsigned long vm_start =3D vma->vm_start; + + if (vma->vm_flags & VM_GROWSDOWN) { + vm_start -=3D stack_guard_gap; + if (vm_start > vma->vm_start) + vm_start =3D 0; + } + return vm_start; +} + +static inline unsigned long vm_end_gap(struct vm_area_struct *vma) +{ + unsigned long vm_end =3D vma->vm_end; + + if (vma->vm_flags & VM_GROWSUP) { + vm_end +=3D stack_guard_gap; + if (vm_end < vma->vm_end) + vm_end =3D -PAGE_SIZE; + } + return vm_end; +} + static inline unsigned long vma_pages(struct vm_area_struct *vma) { return (vma->vm_end - vma->vm_start) >> PAGE_SHIFT; diff --git a/mm/gup.c b/mm/gup.c index 2e4b9873b5aa..4d2fd27b33ab 100644 --- a/mm/gup.c +++ b/mm/gup.c @@ -266,11 +266,6 @@ static int faultin_page(struct task_struct *tsk, struc= t vm_area_struct *vma, unsigned int fault_flags =3D 0; int ret; =20 - /* For mlock, just skip the stack guard page. */ - if ((*flags & FOLL_MLOCK) && - (stack_guard_page_start(vma, address) || - stack_guard_page_end(vma, address + PAGE_SIZE))) - return -ENOENT; if (*flags & FOLL_WRITE) fault_flags |=3D FAULT_FLAG_WRITE; if (nonblocking) diff --git a/mm/memory.c b/mm/memory.c index 4e03447b1ef2..ea9698d1b865 100644 --- a/mm/memory.c +++ b/mm/memory.c @@ -2589,40 +2589,6 @@ static int do_swap_page(struct mm_struct *mm, struct= vm_area_struct *vma, } =20 /* - * This is like a special single-page "expand_{down|up}wards()", - * except we must first make sure that 'address{-|+}PAGE_SIZE' - * doesn't hit another vma. - */ -static inline int check_stack_guard_page(struct vm_area_struct *vma, unsig= ned long address) -{ - address &=3D PAGE_MASK; - if ((vma->vm_flags & VM_GROWSDOWN) && address =3D=3D vma->vm_start) { - struct vm_area_struct *prev =3D vma->vm_prev; - - /* - * Is there a mapping abutting this one below? - * - * That's only ok if it's the same stack mapping - * that has gotten split.. - */ - if (prev && prev->vm_end =3D=3D address) - return prev->vm_flags & VM_GROWSDOWN ? 0 : -ENOMEM; - - return expand_downwards(vma, address - PAGE_SIZE); - } - if ((vma->vm_flags & VM_GROWSUP) && address + PAGE_SIZE =3D=3D vma->vm_en= d) { - struct vm_area_struct *next =3D vma->vm_next; - - /* As VM_GROWSDOWN but s/below/above/ */ - if (next && next->vm_start =3D=3D address + PAGE_SIZE) - return next->vm_flags & VM_GROWSUP ? 0 : -ENOMEM; - - return expand_upwards(vma, address + PAGE_SIZE); - } - return 0; -} - -/* * We enter with non-exclusive mmap_sem (to exclude vma changes, * but allow concurrent faults), and pte mapped but not yet locked. * We return with mmap_sem still held, but pte unmapped and unlocked. @@ -2641,10 +2607,6 @@ static int do_anonymous_page(struct mm_struct *mm, s= truct vm_area_struct *vma, if (vma->vm_flags & VM_SHARED) return VM_FAULT_SIGBUS; =20 - /* Check if we need to add a guard page to the stack */ - if (check_stack_guard_page(vma, address) < 0) - return VM_FAULT_SIGSEGV; - /* Use the zero-page for reads */ if (!(flags & FAULT_FLAG_WRITE)) { entry =3D pte_mkspecial(pfn_pte(my_zero_pfn(address), diff --git a/mm/mmap.c b/mm/mmap.c index b49641901093..03b34261aa08 100644 --- a/mm/mmap.c +++ b/mm/mmap.c @@ -266,6 +266,7 @@ SYSCALL_DEFINE1(brk, unsigned long, brk) unsigned long rlim, retval; unsigned long newbrk, oldbrk; struct mm_struct *mm =3D current->mm; + struct vm_area_struct *next; unsigned long min_brk; bool populate; =20 @@ -311,7 +312,8 @@ SYSCALL_DEFINE1(brk, unsigned long, brk) } =20 /* Check against existing mmap mappings. */ - if (find_vma_intersection(mm, oldbrk, newbrk+PAGE_SIZE)) + next =3D find_vma(mm, oldbrk); + if (next && newbrk + PAGE_SIZE > vm_start_gap(next)) goto out; =20 /* Ok, looks good - let it rip. */ @@ -334,10 +336,22 @@ SYSCALL_DEFINE1(brk, unsigned long, brk) =20 static long vma_compute_subtree_gap(struct vm_area_struct *vma) { - unsigned long max, subtree_gap; - max =3D vma->vm_start; - if (vma->vm_prev) - max -=3D vma->vm_prev->vm_end; + unsigned long max, prev_end, subtree_gap; + + /* + * Note: in the rare case of a VM_GROWSDOWN above a VM_GROWSUP, we + * allow two stack_guard_gaps between them here, and when choosing + * an unmapped area; whereas when expanding we only require one. + * That's a little inconsistent, but keeps the code here simpler. + */ + max =3D vm_start_gap(vma); + if (vma->vm_prev) { + prev_end =3D vm_end_gap(vma->vm_prev); + if (max > prev_end) + max -=3D prev_end; + else + max =3D 0; + } if (vma->vm_rb.rb_left) { subtree_gap =3D rb_entry(vma->vm_rb.rb_left, struct vm_area_struct, vm_rb)->rb_subtree_gap; @@ -426,7 +440,7 @@ static void validate_mm(struct mm_struct *mm) anon_vma_unlock_read(anon_vma); } =20 - highest_address =3D vma->vm_end; + highest_address =3D vm_end_gap(vma); vma =3D vma->vm_next; i++; } @@ -594,7 +608,7 @@ void __vma_link_rb(struct mm_struct *mm, struct vm_area= _struct *vma, if (vma->vm_next) vma_gap_update(vma->vm_next); else - mm->highest_vm_end =3D vma->vm_end; + mm->highest_vm_end =3D vm_end_gap(vma); =20 /* * vma->vm_prev wasn't known when we followed the rbtree to find the @@ -846,7 +860,7 @@ again: remove_next =3D 1 + (end > next->vm_end); vma_gap_update(vma); if (end_changed) { if (!next) - mm->highest_vm_end =3D end; + mm->highest_vm_end =3D vm_end_gap(vma); else if (!adjust_next) vma_gap_update(next); } @@ -889,7 +903,7 @@ again: remove_next =3D 1 + (end > next->vm_end); else if (next) vma_gap_update(next); else - mm->highest_vm_end =3D end; + VM_WARN_ON(mm->highest_vm_end !=3D vm_end_gap(vma)); } if (insert && file) uprobe_mmap(insert); @@ -1702,7 +1716,7 @@ unsigned long unmapped_area(struct vm_unmapped_area_i= nfo *info) =20 while (true) { /* Visit left subtree if it looks promising */ - gap_end =3D vma->vm_start; + gap_end =3D vm_start_gap(vma); if (gap_end >=3D low_limit && vma->vm_rb.rb_left) { struct vm_area_struct *left =3D rb_entry(vma->vm_rb.rb_left, @@ -1713,12 +1727,13 @@ unsigned long unmapped_area(struct vm_unmapped_area= _info *info) } } =20 - gap_start =3D vma->vm_prev ? vma->vm_prev->vm_end : 0; + gap_start =3D vma->vm_prev ? vm_end_gap(vma->vm_prev) : 0; check_current: /* Check if current node has a suitable gap */ if (gap_start > high_limit) return -ENOMEM; - if (gap_end >=3D low_limit && gap_end - gap_start >=3D length) + if (gap_end >=3D low_limit && + gap_end > gap_start && gap_end - gap_start >=3D length) goto found; =20 /* Visit right subtree if it looks promising */ @@ -1740,8 +1755,8 @@ unsigned long unmapped_area(struct vm_unmapped_area_i= nfo *info) vma =3D rb_entry(rb_parent(prev), struct vm_area_struct, vm_rb); if (prev =3D=3D vma->vm_rb.rb_left) { - gap_start =3D vma->vm_prev->vm_end; - gap_end =3D vma->vm_start; + gap_start =3D vm_end_gap(vma->vm_prev); + gap_end =3D vm_start_gap(vma); goto check_current; } } @@ -1805,7 +1820,7 @@ unsigned long unmapped_area_topdown(struct vm_unmappe= d_area_info *info) =20 while (true) { /* Visit right subtree if it looks promising */ - gap_start =3D vma->vm_prev ? vma->vm_prev->vm_end : 0; + gap_start =3D vma->vm_prev ? vm_end_gap(vma->vm_prev) : 0; if (gap_start <=3D high_limit && vma->vm_rb.rb_right) { struct vm_area_struct *right =3D rb_entry(vma->vm_rb.rb_right, @@ -1818,10 +1833,11 @@ unsigned long unmapped_area_topdown(struct vm_unmap= ped_area_info *info) =20 check_current: /* Check if current node has a suitable gap */ - gap_end =3D vma->vm_start; + gap_end =3D vm_start_gap(vma); if (gap_end < low_limit) return -ENOMEM; - if (gap_start <=3D high_limit && gap_end - gap_start >=3D length) + if (gap_start <=3D high_limit && + gap_end > gap_start && gap_end - gap_start >=3D length) goto found; =20 /* Visit left subtree if it looks promising */ @@ -1844,7 +1860,7 @@ unsigned long unmapped_area_topdown(struct vm_unmappe= d_area_info *info) struct vm_area_struct, vm_rb); if (prev =3D=3D vma->vm_rb.rb_right) { gap_start =3D vma->vm_prev ? - vma->vm_prev->vm_end : 0; + vm_end_gap(vma->vm_prev) : 0; goto check_current; } } @@ -1882,7 +1898,7 @@ arch_get_unmapped_area(struct file *filp, unsigned lo= ng addr, unsigned long len, unsigned long pgoff, unsigned long flags) { struct mm_struct *mm =3D current->mm; - struct vm_area_struct *vma; + struct vm_area_struct *vma, *prev; struct vm_unmapped_area_info info; =20 if (len > TASK_SIZE - mmap_min_addr) @@ -1893,9 +1909,10 @@ arch_get_unmapped_area(struct file *filp, unsigned l= ong addr, =20 if (addr) { addr =3D PAGE_ALIGN(addr); - vma =3D find_vma(mm, addr); + vma =3D find_vma_prev(mm, addr, &prev); if (TASK_SIZE - len >=3D addr && addr >=3D mmap_min_addr && - (!vma || addr + len <=3D vma->vm_start)) + (!vma || addr + len <=3D vm_start_gap(vma)) && + (!prev || addr >=3D vm_end_gap(prev))) return addr; } =20 @@ -1918,7 +1935,7 @@ arch_get_unmapped_area_topdown(struct file *filp, con= st unsigned long addr0, const unsigned long len, const unsigned long pgoff, const unsigned long flags) { - struct vm_area_struct *vma; + struct vm_area_struct *vma, *prev; struct mm_struct *mm =3D current->mm; unsigned long addr =3D addr0; struct vm_unmapped_area_info info; @@ -1933,9 +1950,10 @@ arch_get_unmapped_area_topdown(struct file *filp, co= nst unsigned long addr0, /* requesting a specific address */ if (addr) { addr =3D PAGE_ALIGN(addr); - vma =3D find_vma(mm, addr); + vma =3D find_vma_prev(mm, addr, &prev); if (TASK_SIZE - len >=3D addr && addr >=3D mmap_min_addr && - (!vma || addr + len <=3D vma->vm_start)) + (!vma || addr + len <=3D vm_start_gap(vma)) && + (!prev || addr >=3D vm_end_gap(prev))) return addr; } =20 @@ -2061,21 +2079,19 @@ find_vma_prev(struct mm_struct *mm, unsigned long a= ddr, * update accounting. This is shared with both the * grow-up and grow-down cases. */ -static int acct_stack_growth(struct vm_area_struct *vma, unsigned long siz= e, unsigned long grow) +static int acct_stack_growth(struct vm_area_struct *vma, + unsigned long size, unsigned long grow) { struct mm_struct *mm =3D vma->vm_mm; struct rlimit *rlim =3D current->signal->rlim; - unsigned long new_start, actual_size; + unsigned long new_start; =20 /* address space limit tests */ if (!may_expand_vm(mm, grow)) return -ENOMEM; =20 /* Stack limit test */ - actual_size =3D size; - if (size && (vma->vm_flags & (VM_GROWSUP | VM_GROWSDOWN))) - actual_size -=3D PAGE_SIZE; - if (actual_size > ACCESS_ONCE(rlim[RLIMIT_STACK].rlim_cur)) + if (size > ACCESS_ONCE(rlim[RLIMIT_STACK].rlim_cur)) return -ENOMEM; =20 /* mlock limit tests */ @@ -2116,16 +2132,32 @@ static int acct_stack_growth(struct vm_area_struct = *vma, unsigned long size, uns */ int expand_upwards(struct vm_area_struct *vma, unsigned long address) { + struct vm_area_struct *next; + unsigned long gap_addr; int error =3D 0; =20 if (!(vma->vm_flags & VM_GROWSUP)) return -EFAULT; =20 - /* Guard against wrapping around to address 0. */ - if (address < PAGE_ALIGN(address+4)) - address =3D PAGE_ALIGN(address+4); - else + /* Guard against exceeding limits of the address space. */ + address &=3D PAGE_MASK; + if (address >=3D TASK_SIZE) return -ENOMEM; + address +=3D PAGE_SIZE; + + /* Enforce stack_guard_gap */ + gap_addr =3D address + stack_guard_gap; + + /* Guard against overflow */ + if (gap_addr < address || gap_addr > TASK_SIZE) + gap_addr =3D TASK_SIZE; + + next =3D vma->vm_next; + if (next && next->vm_start < gap_addr) { + if (!(next->vm_flags & VM_GROWSUP)) + return -ENOMEM; + /* Check that both stack segments have the same anon_vma? */ + } =20 /* We must make sure the anon_vma is allocated. */ if (unlikely(anon_vma_prepare(vma))) @@ -2167,7 +2199,7 @@ int expand_upwards(struct vm_area_struct *vma, unsign= ed long address) if (vma->vm_next) vma_gap_update(vma->vm_next); else - vma->vm_mm->highest_vm_end =3D address; + vma->vm_mm->highest_vm_end =3D vm_end_gap(vma); spin_unlock(&vma->vm_mm->page_table_lock); =20 perf_event_mmap(vma); @@ -2187,6 +2219,8 @@ int expand_upwards(struct vm_area_struct *vma, unsign= ed long address) int expand_downwards(struct vm_area_struct *vma, unsigned long address) { + struct vm_area_struct *prev; + unsigned long gap_addr; int error; =20 address &=3D PAGE_MASK; @@ -2194,6 +2228,17 @@ int expand_downwards(struct vm_area_struct *vma, if (error) return error; =20 + /* Enforce stack_guard_gap */ + gap_addr =3D address - stack_guard_gap; + if (gap_addr > address) + return -ENOMEM; + prev =3D vma->vm_prev; + if (prev && prev->vm_end > gap_addr) { + if (!(prev->vm_flags & VM_GROWSDOWN)) + return -ENOMEM; + /* Check that both stack segments have the same anon_vma? */ + } + /* We must make sure the anon_vma is allocated. */ if (unlikely(anon_vma_prepare(vma))) return -ENOMEM; @@ -2245,28 +2290,25 @@ int expand_downwards(struct vm_area_struct *vma, return error; } =20 -/* - * Note how expand_stack() refuses to expand the stack all the way to - * abut the next virtual mapping, *unless* that mapping itself is also - * a stack mapping. We want to leave room for a guard page, after all - * (the guard page itself is not added here, that is done by the - * actual page faulting logic) - * - * This matches the behavior of the guard page logic (see mm/memory.c: - * check_stack_guard_page()), which only allows the guard page to be - * removed under these circumstances. - */ +/* enforced gap between the expanding stack and other mappings. */ +unsigned long stack_guard_gap =3D 256UL<vm_next; - if (next && next->vm_start =3D=3D address + PAGE_SIZE) { - if (!(next->vm_flags & VM_GROWSUP)) - return -ENOMEM; - } return expand_upwards(vma, address); } =20 @@ -2288,14 +2330,6 @@ find_extend_vma(struct mm_struct *mm, unsigned long = addr) #else int expand_stack(struct vm_area_struct *vma, unsigned long address) { - struct vm_area_struct *prev; - - address &=3D PAGE_MASK; - prev =3D vma->vm_prev; - if (prev && prev->vm_end =3D=3D address) { - if (!(prev->vm_flags & VM_GROWSDOWN)) - return -ENOMEM; - } return expand_downwards(vma, address); } =20 @@ -2391,7 +2425,7 @@ detach_vmas_to_be_unmapped(struct mm_struct *mm, stru= ct vm_area_struct *vma, vma->vm_prev =3D prev; vma_gap_update(vma); } else - mm->highest_vm_end =3D prev ? prev->vm_end : 0; + mm->highest_vm_end =3D prev ? vm_end_gap(prev) : 0; tail_vma->vm_next =3D NULL; =20 /* Kill the cache */ diff --git a/net/rxrpc/ar-key.c b/net/rxrpc/ar-key.c index 0ad080790a32..99d5a5ff812e 100644 --- a/net/rxrpc/ar-key.c +++ b/net/rxrpc/ar-key.c @@ -213,7 +213,7 @@ static int rxrpc_krb5_decode_principal(struct krb5_prin= cipal *princ, unsigned int *_toklen) { const __be32 *xdr =3D *_xdr; - unsigned int toklen =3D *_toklen, n_parts, loop, tmp; + unsigned int toklen =3D *_toklen, n_parts, loop, tmp, paddedlen; =20 /* there must be at least one name, and at least #names+1 length * words */ @@ -243,16 +243,16 @@ static int rxrpc_krb5_decode_principal(struct krb5_pr= incipal *princ, toklen -=3D 4; if (tmp <=3D 0 || tmp > AFSTOKEN_STRING_MAX) return -EINVAL; - if (tmp > toklen) + paddedlen =3D (tmp + 3) & ~3; + if (paddedlen > toklen) return -EINVAL; princ->name_parts[loop] =3D kmalloc(tmp + 1, GFP_KERNEL); if (!princ->name_parts[loop]) return -ENOMEM; memcpy(princ->name_parts[loop], xdr, tmp); princ->name_parts[loop][tmp] =3D 0; - tmp =3D (tmp + 3) & ~3; - toklen -=3D tmp; - xdr +=3D tmp >> 2; + toklen -=3D paddedlen; + xdr +=3D paddedlen >> 2; } =20 if (toklen < 4) @@ -261,16 +261,16 @@ static int rxrpc_krb5_decode_principal(struct krb5_pr= incipal *princ, toklen -=3D 4; if (tmp <=3D 0 || tmp > AFSTOKEN_K5_REALM_MAX) return -EINVAL; - if (tmp > toklen) + paddedlen =3D (tmp + 3) & ~3; + if (paddedlen > toklen) return -EINVAL; princ->realm =3D kmalloc(tmp + 1, GFP_KERNEL); if (!princ->realm) return -ENOMEM; memcpy(princ->realm, xdr, tmp); princ->realm[tmp] =3D 0; - tmp =3D (tmp + 3) & ~3; - toklen -=3D tmp; - xdr +=3D tmp >> 2; + toklen -=3D paddedlen; + xdr +=3D paddedlen >> 2; =20 _debug("%s/...@%s", princ->name_parts[0], princ->realm); =20 @@ -289,7 +289,7 @@ static int rxrpc_krb5_decode_tagged_data(struct krb5_ta= gged_data *td, unsigned int *_toklen) { const __be32 *xdr =3D *_xdr; - unsigned int toklen =3D *_toklen, len; + unsigned int toklen =3D *_toklen, len, paddedlen; =20 /* there must be at least one tag and one length word */ if (toklen <=3D 8) @@ -303,15 +303,17 @@ static int rxrpc_krb5_decode_tagged_data(struct krb5_= tagged_data *td, toklen -=3D 8; if (len > max_data_size) return -EINVAL; + paddedlen =3D (len + 3) & ~3; + if (paddedlen > toklen) + return -EINVAL; td->data_len =3D len; =20 if (len > 0) { td->data =3D kmemdup(xdr, len, GFP_KERNEL); if (!td->data) return -ENOMEM; - len =3D (len + 3) & ~3; - toklen -=3D len; - xdr +=3D len >> 2; + toklen -=3D paddedlen; + xdr +=3D paddedlen >> 2; } =20 _debug("tag %x len %x", td->tag, td->data_len); @@ -383,7 +385,7 @@ static int rxrpc_krb5_decode_ticket(u8 **_ticket, u16 *= _tktlen, const __be32 **_xdr, unsigned int *_toklen) { const __be32 *xdr =3D *_xdr; - unsigned int toklen =3D *_toklen, len; + unsigned int toklen =3D *_toklen, len, paddedlen; =20 /* there must be at least one length word */ if (toklen <=3D 4) @@ -395,6 +397,9 @@ static int rxrpc_krb5_decode_ticket(u8 **_ticket, u16 *= _tktlen, toklen -=3D 4; if (len > AFSTOKEN_K5_TIX_MAX) return -EINVAL; + paddedlen =3D (len + 3) & ~3; + if (paddedlen > toklen) + return -EINVAL; *_tktlen =3D len; =20 _debug("ticket len %u", len); @@ -403,9 +408,8 @@ static int rxrpc_krb5_decode_ticket(u8 **_ticket, u16 *= _tktlen, *_ticket =3D kmemdup(xdr, len, GFP_KERNEL); if (!*_ticket) return -ENOMEM; - len =3D (len + 3) & ~3; - toklen -=3D len; - xdr +=3D len >> 2; + toklen -=3D paddedlen; + xdr +=3D paddedlen >> 2; } =20 *_xdr =3D xdr; @@ -549,7 +553,7 @@ static int rxrpc_instantiate_xdr(struct key *key, const= void *data, size_t datal { const __be32 *xdr =3D data, *token; const char *cp; - unsigned int len, tmp, loop, ntoken, toklen, sec_ix; + unsigned int len, paddedlen, loop, ntoken, toklen, sec_ix; int ret; =20 _enter(",{%x,%x,%x,%x},%zu", @@ -574,22 +578,21 @@ static int rxrpc_instantiate_xdr(struct key *key, con= st void *data, size_t datal if (len < 1 || len > AFSTOKEN_CELL_MAX) goto not_xdr; datalen -=3D 4; - tmp =3D (len + 3) & ~3; - if (tmp > datalen) + paddedlen =3D (len + 3) & ~3; + if (paddedlen > datalen) goto not_xdr; =20 cp =3D (const char *) xdr; for (loop =3D 0; loop < len; loop++) if (!isprint(cp[loop])) goto not_xdr; - if (len < tmp) - for (; loop < tmp; loop++) - if (cp[loop]) - goto not_xdr; + for (; loop < paddedlen; loop++) + if (cp[loop]) + goto not_xdr; _debug("cellname: [%u/%u] '%*.*s'", - len, tmp, len, len, (const char *) xdr); - datalen -=3D tmp; - xdr +=3D tmp >> 2; + len, paddedlen, len, len, (const char *) xdr); + datalen -=3D paddedlen; + xdr +=3D paddedlen >> 2; =20 /* get the token count */ if (datalen < 12) @@ -610,10 +613,11 @@ static int rxrpc_instantiate_xdr(struct key *key, con= st void *data, size_t datal sec_ix =3D ntohl(*xdr); datalen -=3D 4; _debug("token: [%x/%zx] %x", toklen, datalen, sec_ix); - if (toklen < 20 || toklen > datalen) + paddedlen =3D (toklen + 3) & ~3; + if (toklen < 20 || toklen > datalen || paddedlen > datalen) goto not_xdr; - datalen -=3D (toklen + 3) & ~3; - xdr +=3D (toklen + 3) >> 2; + datalen -=3D paddedlen; + xdr +=3D paddedlen >> 2; =20 } while (--loop > 0); =20 =0D --=-ft4PniS/RVXbNQHpcsmr-- --=-SO4gYKpFKkHHJamZraaY Content-Type: application/pgp-signature; name="signature.asc" Content-Description: This is a digitally signed message part -----BEGIN PGP SIGNATURE----- iQIzBAABCgAdFiEErCspvTSmr92z9o8157/I7JWGEQkFAllaZNYACgkQ57/I7JWG EQkg0Q/+N449jSqipBI1XccWLVVLINc0gHVKAYKojHxR3yCsfIxzAwcaL3AKnUjw +LhF4fkdY2BHyshpf8W1XDhy0Lk5TNqSEdO7ny5CXCOiKej416ggY86IgolLqzqH cVNkco7xnB3aD8parCexAsXdNk0t+gC7DTzR2t30OJaaNu/lTCmPfNYeN9nkCXyU b39B2H7IIsp/UxO7e4k1VrwgU5NcH2L/ay+hncvIgLxfWjHzEcern/FWwmLXhn++ Vg3FeVMo0EInSDkyCPOPlP38aXIxwvNfVCTYHgtXvqvQ0dqBZwTf8hBGxIcHQsmC Qo9q1ICyd/4j5e5R6MH+D2SQgZyRpG1nThBbb3k5ONw7qsyRe7t1ZIa+dWIdk8mW kmZv5J5jr7Se5lCvvZ1q8wSTfJ1e61LONbe3VP1HmOGDnmAfA8cOJI2Epk0SidDD w1vVaHTaHNCVZg8Rd6BjIk0r4XOmB/k0TX9A+fJpNSiMJedEGCWJ1U31FRvXYRcw iLEG0h9O/Qas2s4PvulrzcTIVdAnfoC5Tumkpn30Ww8cWssoXNbx/H3FIyJY3Uxf iRifO5FiVqU93A4AhlpK+3lT7bL266LL3IqKMJ8JU0EpClk05nak+/Ei7TPzM0DE RWRvckkjSfxYoQLT+2ZnYY+2xQiEHnnzy81dKC0xwDaD+PrkCHY= =Nbbp -----END PGP SIGNATURE----- --=-SO4gYKpFKkHHJamZraaY--