7660a6fddc
mm: allow slab_nomerge to be set at build time
...
Some hardened environments want to build kernels with slab_nomerge
already set (so that they do not depend on remembering to set the kernel
command line option). This is desired to reduce the risk of kernel heap
overflows being able to overwrite objects from merged caches and changes
the requirements for cache layout control, increasing the difficulty of
these attacks. By keeping caches unmerged, these kinds of exploits can
usually only damage objects in the same cache (though the risk to
metadata exploitation is unchanged).
Link: http://lkml.kernel.org/r/20170620230911.GA25238@beast
Signed-off-by: Kees Cook <keescook@chromium.org >
Cc: Daniel Micay <danielmicay@gmail.com >
Cc: David Windsor <dave@nullcore.net >
Cc: Eric Biggers <ebiggers3@gmail.com >
Cc: Christoph Lameter <cl@linux.com >
Cc: Jonathan Corbet <corbet@lwn.net >
Cc: Daniel Micay <danielmicay@gmail.com >
Cc: David Windsor <dave@nullcore.net >
Cc: Eric Biggers <ebiggers3@gmail.com >
Cc: Pekka Enberg <penberg@kernel.org >
Cc: David Rientjes <rientjes@google.com >
Cc: Joonsoo Kim <iamjoonsoo.kim@lge.com >
Cc: "Rafael J. Wysocki" <rafael.j.wysocki@intel.com >
Cc: Thomas Gleixner <tglx@linutronix.de >
Cc: Ingo Molnar <mingo@kernel.org >
Cc: Mauro Carvalho Chehab <mchehab@kernel.org >
Cc: "Paul E. McKenney" <paulmck@linux.vnet.ibm.com >
Cc: Arnd Bergmann <arnd@arndb.de >
Cc: Andy Lutomirski <luto@kernel.org >
Cc: Nicolas Pitre <nicolas.pitre@linaro.org >
Cc: Tejun Heo <tj@kernel.org >
Cc: Daniel Mack <daniel@zonque.org >
Cc: Sebastian Andrzej Siewior <bigeasy@linutronix.de >
Cc: Sergey Senozhatsky <sergey.senozhatsky@gmail.com >
Cc: Helge Deller <deller@gmx.de >
Cc: Rik van Riel <riel@redhat.com >
Cc: Randy Dunlap <rdunlap@infradead.org >
Signed-off-by: Andrew Morton <akpm@linux-foundation.org >
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org >
2017-07-06 16:24:31 -07:00
e077195029
mm/slab.c: replace open-coded round-up code with ALIGN
...
Link: http://lkml.kernel.org/r/20170616072918epcms5p4ff16c24ef8472b4c3b4371823cd87856@epcms5p4
Signed-off-by: Canjiang Lu <canjiang.lu@samsung.com >
Cc: Christoph Lameter <cl@linux.com >
Cc: Pekka Enberg <penberg@kernel.org >
Cc: David Rientjes <rientjes@google.com >
Cc: Joonsoo Kim <iamjoonsoo.kim@lge.com >
Signed-off-by: Andrew Morton <akpm@linux-foundation.org >
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org >
2017-07-06 16:24:30 -07:00
e6d0e1dcf5
mm/slub.c: wrap kmem_cache->cpu_partial in config CONFIG_SLUB_CPU_PARTIAL
...
kmem_cache->cpu_partial is just used when CONFIG_SLUB_CPU_PARTIAL is
set, so wrap it with config CONFIG_SLUB_CPU_PARTIAL will save some space
on 32bit arch.
This patch wraps kmem_cache->cpu_partial in config CONFIG_SLUB_CPU_PARTIAL
and wraps its sysfs too.
Link: http://lkml.kernel.org/r/20170502144533.10729-4-richard.weiyang@gmail.com
Signed-off-by: Wei Yang <richard.weiyang@gmail.com >
Cc: Christoph Lameter <cl@linux.com >
Cc: Pekka Enberg <penberg@kernel.org >
Cc: David Rientjes <rientjes@google.com >
Cc: Joonsoo Kim <iamjoonsoo.kim@lge.com >
Signed-off-by: Andrew Morton <akpm@linux-foundation.org >
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org >
2017-07-06 16:24:30 -07:00
a93cf07bc3
mm/slub.c: wrap cpu_slab->partial in CONFIG_SLUB_CPU_PARTIAL
...
cpu_slab's field partial is used when CONFIG_SLUB_CPU_PARTIAL is set,
which means we can save a pointer's space on each cpu for every slub
item.
This patch wraps cpu_slab->partial in CONFIG_SLUB_CPU_PARTIAL and wraps
its sysfs use too.
[akpm@linux-foundation.org: avoid strange 80-col tricks]
Link: http://lkml.kernel.org/r/20170502144533.10729-3-richard.weiyang@gmail.com
Signed-off-by: Wei Yang <richard.weiyang@gmail.com >
Cc: Christoph Lameter <cl@linux.com >
Cc: Pekka Enberg <penberg@kernel.org >
Cc: David Rientjes <rientjes@google.com >
Cc: Joonsoo Kim <iamjoonsoo.kim@lge.com >
Signed-off-by: Andrew Morton <akpm@linux-foundation.org >
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org >
2017-07-06 16:24:30 -07:00
d3111e6cce
mm/slub.c: pack red_left_pad with another int to save a word
...
Patch series "try to save some memory for kmem_cache in some cases", v2.
kmem_cache is a frequently used data in kernel. During the code
reading, I found maybe we could save some space in some cases.
1. On 64bit arch, type int will occupy a word if it doesn't sit well.
2. cpu_slab->partial is just used when CONFIG_SLUB_CPU_PARTIAL is set
3. cpu_partial is just used when CONFIG_SLUB_CPU_PARTIAL is set, while
just save some space on 32bit arch.
This patch (of 3):
On 64bit arch, struct is 8-bytes aligned, so int will occupy a word if
it doesn't sit well.
This patch pack red_left_pad with reserved to save 8 bytes for struct
kmem_cache on a 64bit arch.
Link: http://lkml.kernel.org/r/20170502144533.10729-2-richard.weiyang@gmail.com
Signed-off-by: Wei Yang <richard.weiyang@gmail.com >
Cc: Christoph Lameter <cl@linux.com >
Cc: Pekka Enberg <penberg@kernel.org >
Cc: David Rientjes <rientjes@google.com >
Cc: Joonsoo Kim <iamjoonsoo.kim@lge.com >
Signed-off-by: Andrew Morton <akpm@linux-foundation.org >
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org >
2017-07-06 16:24:30 -07:00
d4ff6d35f6
mm/slub: reset cpu_slab's pointer in deactivate_slab()
...
Each time a slab is deactivated, the page and freelist pointer should be
reset.
This patch just merges these two options into deactivate_slab().
Link: http://lkml.kernel.org/r/20170507031215.3130-2-richard.weiyang@gmail.com
Signed-off-by: Wei Yang <richard.weiyang@gmail.com >
Cc: Christoph Lameter <cl@linux.com >
Cc: Pekka Enberg <penberg@kernel.org >
Cc: David Rientjes <rientjes@google.com >
Cc: Joonsoo Kim <iamjoonsoo.kim@lge.com >
Signed-off-by: Andrew Morton <akpm@linux-foundation.org >
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org >
2017-07-06 16:24:30 -07:00
66fdbe5203
mm/slub.c: remove a redundant assignment in ___slab_alloc()
...
When the code comes to this point, there are two cases:
1. cpu_slab is deactivated
2. cpu_slab is empty
In both cased, cpu_slab->freelist is NULL at this moment.
This patch removes the redundant assignment of cpu_slab->freelist.
Link: http://lkml.kernel.org/r/20170507031215.3130-1-richard.weiyang@gmail.com
Signed-off-by: Wei Yang <richard.weiyang@gmail.com >
Cc: Christoph Lameter <cl@linux.com >
Cc: Pekka Enberg <penberg@kernel.org >
Cc: David Rientjes <rientjes@google.com >
Cc: Joonsoo Kim <iamjoonsoo.kim@lge.com >
Signed-off-by: Andrew Morton <akpm@linux-foundation.org >
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org >
2017-07-06 16:24:30 -07:00
c823bd9244
fs/file.c: replace alloc_fdmem() with kvmalloc() alternative
...
There is no real reason to duplicate kvmalloc* helpers so drop
alloc_fdmem and replace it with the appropriate library function.
Link: http://lkml.kernel.org/r/20170531155145.17111-2-mhocko@kernel.org
Signed-off-by: Michal Hocko <mhocko@suse.com >
Cc: Alexander Viro <viro@zeniv.linux.org.uk >
Signed-off-by: Andrew Morton <akpm@linux-foundation.org >
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org >
2017-07-06 16:24:30 -07:00
b74271e40e
ocfs2: constify attribute_group structures
...
attribute_groups are not supposed to change at runtime. All functions
working with attribute_groups provided by <linux/sysfs.h> work with
const attribute_group. So mark the non-const structs as const.
File size before:
text data bss dec hex filename
4402 1088 38 5528 1598 fs/ocfs2/stackglue.o
File size After adding 'const':
text data bss dec hex filename
4442 1024 38 5504 1580 fs/ocfs2/stackglue.o
Link: http://lkml.kernel.org/r/cab4e59b4918db3ed2ec77073a4cb310c4429ef5.1498808026.git.arvind.yadav.cs@gmail.com
Signed-off-by: Arvind Yadav <arvind.yadav.cs@gmail.com >
Cc: Mark Fasheh <mfasheh@versity.com >
Cc: Joel Becker <jlbec@evilplan.org >
Cc: Junxiao Bi <junxiao.bi@oracle.com >
Cc: Joseph Qi <jiangqi903@gmail.com >
Signed-off-by: Andrew Morton <akpm@linux-foundation.org >
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org >
2017-07-06 16:24:30 -07:00
25b1c72e15
ocfs2: free 'dummy_sc' in sc_fop_release() to prevent memory leak
...
'sd->dbg_sock' is malloced in sc_common_open(), but not freed at the end
of sc_fop_release().
Link: http://lkml.kernel.org/r/594FB0A4.2050105@huawei.com
Signed-off-by: Jun Piao <piaojun@huawei.com >
Reviewed-by: Joseph Qi <jiangqi903@gmail.com >
Cc: Mark Fasheh <mfasheh@versity.com >
Cc: Joel Becker <jlbec@evilplan.org >
Cc: Junxiao Bi <junxiao.bi@oracle.com >
Signed-off-by: Andrew Morton <akpm@linux-foundation.org >
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org >
2017-07-06 16:24:30 -07:00
62aa81d7c4
ocfs2: use magic.h
...
Filesystems generally use SUPER_MAGIC values from magic.h instead of a
local definition.
Link: http://lkml.kernel.org/r/20170521154217.27917-1-fabf@skynet.be
Signed-off-by: Fabian Frederick <fabf@skynet.be >
Reviewed-by: Mark Fasheh <mfasheh@versity.com >
Cc: Joel Becker <jlbec@evilplan.org >
Cc: Junxiao Bi <junxiao.bi@oracle.com >
Cc: Joseph Qi <jiangqi903@gmail.com >
Signed-off-by: Andrew Morton <akpm@linux-foundation.org >
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org >
2017-07-06 16:24:30 -07:00
8c4d5a4387
ocfs2: fix a static checker warning
...
Fix a static code checker warning:
fs/ocfs2/inode.c:179 ocfs2_iget() warn: passing zero to 'ERR_PTR'
Fixes: d56a8f32e4http://lkml.kernel.org/r/1495516634-1952-1-git-send-email-ghe@suse.com
Signed-off-by: Gang He <ghe@suse.com >
Reviewed-by: Joseph Qi <jiangqi903@gmail.com >
Reviewed-by: Eric Ren <zren@suse.com >
Cc: Mark Fasheh <mfasheh@versity.com >
Cc: Joel Becker <jlbec@evilplan.org >
Cc: Junxiao Bi <junxiao.bi@oracle.com >
Signed-off-by: Andrew Morton <akpm@linux-foundation.org >
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org >
2017-07-06 16:24:30 -07:00
c509e05fc1
drivers/sh/intc/virq.c: delete an error message for a failed memory allocation in add_virq_to_pirq()
...
This issue was detected by using the Coccinelle software.
Link: http://events.linuxfoundation.org/sites/events/files/slides/LCJ16-Refactor_Strings-WSang_0.pdf
Link: http://lkml.kernel.org/r/54e30d61-5183-9911-cf35-1410fb78da5a@users.sourceforge.net
Signed-off-by: Markus Elfring <elfring@users.sourceforge.net >
Signed-off-by: Andrew Morton <akpm@linux-foundation.org >
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org >
2017-07-06 16:24:30 -07:00
820a0b24b2
include/linux/filter.h: use linux/set_memory.h
...
This header always exists, so doesn't require an ifdef around its
inclusion. When CONFIG_ARCH_HAS_SET_MEMORY=y it includes the asm
header, otherwise it provides empty versions of the set_memory_xx()
routines.
Link: http://lkml.kernel.org/r/1498717781-29151-4-git-send-email-mpe@ellerman.id.au
Signed-off-by: Michael Ellerman <mpe@ellerman.id.au >
Acked-by: Daniel Borkmann <daniel@iogearbox.net >
Acked-by: Kees Cook <keescook@chromium.org >
Acked-by: Laura Abbott <labbott@redhat.com >
Signed-off-by: Andrew Morton <akpm@linux-foundation.org >
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org >
2017-07-06 16:24:30 -07:00
563ec5cbc6
kernel/module.c: use linux/set_memory.h
...
This header always exists, so doesn't require an ifdef around its
inclusion. When CONFIG_ARCH_HAS_SET_MEMORY=y it includes the asm
header, otherwise it provides empty versions of the set_memory_xx()
routines.
The usages of set_memory_xx() are still guarded by
CONFIG_STRICT_MODULE_RWX.
Link: http://lkml.kernel.org/r/1498717781-29151-3-git-send-email-mpe@ellerman.id.au
Signed-off-by: Michael Ellerman <mpe@ellerman.id.au >
Acked-by: Kees Cook <keescook@chromium.org >
Acked-by: Laura Abbott <labbott@redhat.com >
Cc: Daniel Borkmann <daniel@iogearbox.net >
Signed-off-by: Andrew Morton <akpm@linux-foundation.org >
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org >
2017-07-06 16:24:30 -07:00
61f6d09a93
kernel/power/snapshot.c: use linux/set_memory.h
...
This header always exists, so doesn't require an ifdef around its
inclusion. When CONFIG_ARCH_HAS_SET_MEMORY=y it includes the asm
header, otherwise it provides empty versions of the set_memory_xx()
routines.
Link: http://lkml.kernel.org/r/1498717781-29151-2-git-send-email-mpe@ellerman.id.au
Signed-off-by: Michael Ellerman <mpe@ellerman.id.au >
Acked-by: Kees Cook <keescook@chromium.org >
Acked-by: Laura Abbott <labbott@redhat.com >
Cc: Daniel Borkmann <daniel@iogearbox.net >
Signed-off-by: Andrew Morton <akpm@linux-foundation.org >
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org >
2017-07-06 16:24:30 -07:00
938f846492
provide linux/set_memory.h
...
Currently code that wants to use set_memory_ro() etc, needs to include
asm/set_memory.h, which doesn't exist on all arches. Some code knows it
only builds on arches which have the header, other code guards the
inclusion with an #ifdef, neither is ideal.
So create linux/set_memory.h. This always exists, so users don't need
an #ifdef just to include the header.
When CONFIG_ARCH_HAS_SET_MEMORY=y it includes asm/set_memory.h,
otherwise it provides empty non-failing implementations.
Link: http://lkml.kernel.org/r/1498717781-29151-1-git-send-email-mpe@ellerman.id.au
Signed-off-by: Michael Ellerman <mpe@ellerman.id.au >
Acked-by: Daniel Borkmann <daniel@iogearbox.net >
Acked-by: Kees Cook <keescook@chromium.org >
Acked-by: Laura Abbott <labbott@redhat.com >
Signed-off-by: Andrew Morton <akpm@linux-foundation.org >
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org >
2017-07-06 16:24:30 -07:00
d9f91f844c
scripts/spelling.txt: add a bunch more spelling mistakes
...
Here are some of the more spelling mistakes and typos that I've found
while fixing up spelling mistakes in kernel error message text over the
past several weeks.
Link: http://lkml.kernel.org/r/20170621142614.12529-1-colin.king@canonical.com
Signed-off-by: Colin Ian King <colin.king@canonical.com >
Acked-by: Kees Cook <keescook@chromium.org >
Cc: Joe Perches <joe@perches.com >
Cc: Stephen Boyd <sboyd@codeaurora.org >
Cc: Ross Zwisler <ross.zwisler@linux.intel.com >
Cc: Masahiro Yamada <yamada.masahiro@socionext.com >
Signed-off-by: Andrew Morton <akpm@linux-foundation.org >
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org >
2017-07-06 16:24:30 -07:00
f2e8954b0d
ramfs: clarify help text that compression applies to ramfs as well as legacy ramdisk.
...
Clarify help text that compression applies to ramfs as well as legacy ramdisk.
Link: http://lkml.kernel.org/r/f206a960-5a61-cf59-f27c-e9f34872063c@landley.net
Signed-off-by: Rob Landley <rob@landley.net >
Cc: Jonathan Corbet <corbet@lwn.net >
Signed-off-by: Andrew Morton <akpm@linux-foundation.org >
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org >
2017-07-06 16:24:30 -07:00
595a22acee
scripts/gen_initramfs_list.sh: teach INITRAMFS_ROOT_UID and INITRAMFS_ROOT_GID that -1 means "current user".
...
Teach INITRAMFS_ROOT_UID and INITRAMFS_ROOT_GID that -1 means "current user".
Link: http://lkml.kernel.org/r/2df3a9fb-4378-fa16-679d-99e788926c05@landley.net
Signed-off-by: Rob Landley <rob@landley.net >
Cc: Michal Marek <mmarek@suse.com >
Signed-off-by: Andrew Morton <akpm@linux-foundation.org >
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org >
2017-07-06 16:24:29 -07:00
3922920026
tile: provide default ioremap declaration
...
Add a default ioremap function which was not provided in all
circumstances. (Only when CONFIG_PCI and CONFIG_TILEGX was set).
I have designs to use them in scatterlist.c where they'd likely never be
called with this architecture, but it is needed to compile. Thus, if
the function is ever hit it returns NULL.
Link: http://lkml.kernel.org/r/1495726904-27380-1-git-send-email-logang@deltatee.com
Signed-off-by: Logan Gunthorpe <logang@deltatee.com >
Signed-off-by: Stephen Bates <sbates@raithlin.com >
Cc: Chris Metcalf <cmetcalf@mellanox.com >
Cc: Mel Gorman <mgorman@techsingularity.net >
Cc: Michal Hocko <mhocko@suse.com >
Cc: Johannes Weiner <hannes@cmpxchg.org >
Cc: Vlastimil Babka <vbabka@suse.cz >
Cc: Al Viro <viro@ZenIV.linux.org.uk >
Signed-off-by: Andrew Morton <akpm@linux-foundation.org >
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org >
2017-07-06 16:24:29 -07:00
9cfc5e0454
mn10300: use generic fb.h
...
The mn10300 arch uses a verbatim copy of the asm-generic version and
does not add any own implementations to the header, so use
asm-generic/fb.h instead of duplicating code.
Link: http://lkml.kernel.org/r/20170517083348.1815-1-tklauser@distanz.ch
Signed-off-by: Tobias Klauser <tklauser@distanz.ch >
Reviewed-by: David Howells <dhowells@redhat.com >
Signed-off-by: Andrew Morton <akpm@linux-foundation.org >
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org >
2017-07-06 16:24:29 -07:00
dc5131641d
mn10300: remove wrapper header for asm/device.h
...
mn10300's asm/device.h is merely including asm-generic/device.h. Thus,
the arch specific header can be omitted and the generic header can be
used directly.
Link: http://lkml.kernel.org/r/20170517124857.26834-1-tklauser@distanz.ch
Signed-off-by: Tobias Klauser <tklauser@distanz.ch >
Cc: David Howells <dhowells@redhat.com >
Signed-off-by: Andrew Morton <akpm@linux-foundation.org >
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org >
2017-07-06 16:24:29 -07:00
c0d80ddab8
kernel/extable.c: mark core_kernel_text notrace
...
core_kernel_text is used by MIPS in its function graph trace processing,
so having this method traced leads to an infinite set of recursive calls
such as:
Call Trace:
ftrace_return_to_handler+0x50/0x128
core_kernel_text+0x10/0x1b8
prepare_ftrace_return+0x6c/0x114
ftrace_graph_caller+0x20/0x44
return_to_handler+0x10/0x30
return_to_handler+0x0/0x30
return_to_handler+0x0/0x30
ftrace_ops_no_ops+0x114/0x1bc
core_kernel_text+0x10/0x1b8
core_kernel_text+0x10/0x1b8
core_kernel_text+0x10/0x1b8
ftrace_ops_no_ops+0x114/0x1bc
core_kernel_text+0x10/0x1b8
prepare_ftrace_return+0x6c/0x114
ftrace_graph_caller+0x20/0x44
(...)
Mark the function notrace to avoid it being traced.
Link: http://lkml.kernel.org/r/1498028607-6765-1-git-send-email-marcin.nowakowski@imgtec.com
Signed-off-by: Marcin Nowakowski <marcin.nowakowski@imgtec.com >
Reviewed-by: Masami Hiramatsu <mhiramat@kernel.org >
Cc: Peter Zijlstra <peterz@infradead.org >
Cc: Thomas Meyer <thomas@m3y3r.de >
Cc: Ingo Molnar <mingo@kernel.org >
Cc: Steven Rostedt <rostedt@goodmis.org >
Cc: Daniel Borkmann <daniel@iogearbox.net >
Cc: Paul Gortmaker <paul.gortmaker@windriver.com >
Cc: Thomas Gleixner <tglx@linutronix.de >
Cc: <stable@vger.kernel.org >
Signed-off-by: Andrew Morton <akpm@linux-foundation.org >
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org >
2017-07-06 16:24:29 -07:00
bbf29ffc7f
thp, mm: fix crash due race in MADV_FREE handling
...
Reinette reported the following crash:
BUG: Bad page state in process log2exe pfn:57600
page:ffffea00015d8000 count:0 mapcount:0 mapping: (null) index:0x20200
flags: 0x4000000000040019(locked|uptodate|dirty|swapbacked)
raw: 4000000000040019 0000000000000000 0000000000020200 00000000ffffffff
raw: ffffea00015d8020 ffffea00015d8020 0000000000000000 0000000000000000
page dumped because: PAGE_FLAGS_CHECK_AT_FREE flag(s) set
bad because of flags: 0x1(locked)
Modules linked in: rfcomm 8021q bnep intel_rapl x86_pkg_temp_thermal coretemp efivars btusb btrtl btbcm pwm_lpss_pci snd_hda_codec_hdmi btintel pwm_lpss snd_hda_codec_realtek snd_soc_skl snd_hda_codec_generic snd_soc_skl_ipc spi_pxa2xx_platform snd_soc_sst_ipc snd_soc_sst_dsp i2c_designware_platform i2c_designware_core snd_hda_ext_core snd_soc_sst_match snd_hda_intel snd_hda_codec mei_me snd_hda_core mei snd_soc_rt286 snd_soc_rl6347a snd_soc_core efivarfs
CPU: 1 PID: 354 Comm: log2exe Not tainted 4.12.0-rc7-test-test #19
Hardware name: Intel corporation NUC6CAYS/NUC6CAYB, BIOS AYAPLCEL.86A.0027.2016.1108.1529 11/08/2016
Call Trace:
bad_page+0x16a/0x1f0
free_pages_check_bad+0x117/0x190
free_hot_cold_page+0x7b1/0xad0
__put_page+0x70/0xa0
madvise_free_huge_pmd+0x627/0x7b0
madvise_free_pte_range+0x6f8/0x1150
__walk_page_range+0x6b5/0xe30
walk_page_range+0x13b/0x310
madvise_free_page_range.isra.16+0xad/0xd0
madvise_free_single_vma+0x2e4/0x470
SyS_madvise+0x8ce/0x1450
If somebody frees the page under us and we hold the last reference to
it, put_page() would attempt to free the page before unlocking it.
The fix is trivial reorder of operations.
Dave said:
"I came up with the exact same patch. For posterity, here's the test
case, generated by syzkaller and trimmed down by Reinette:
https://www.sr71.net/~dave/intel/log2.c
And the config that helps detect this:
https://www.sr71.net/~dave/intel/config-log2 "
Fixes: b8d3c4c300http://lkml.kernel.org/r/20170628101249.17879-1-kirill.shutemov@linux.intel.com
Signed-off-by: Kirill A. Shutemov <kirill.shutemov@linux.intel.com >
Reported-by: Reinette Chatre <reinette.chatre@intel.com >
Acked-by: Dave Hansen <dave.hansen@intel.com >
Acked-by: Michal Hocko <mhocko@suse.com >
Acked-by: Minchan Kim <minchan@kernel.org >
Cc: Huang Ying <ying.huang@intel.com >
Cc: <stable@vger.kernel.org >
Signed-off-by: Andrew Morton <akpm@linux-foundation.org >
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org >
2017-07-06 16:24:29 -07:00
Kees Cook
Canjiang Lu
Wei Yang
Michal Hocko
Arvind Yadav
piaojun
Fabian Frederick
Gang He
SF Markus Elfring
Michael Ellerman
Colin Ian King
Rob Landley
Logan Gunthorpe
Tobias Klauser
Marcin Nowakowski
Kirill A. Shutemov