From patchwork Wed May 22 21:55:27 2013 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Kamal Mostafa X-Patchwork-Id: 245751 Return-Path: X-Original-To: incoming@patchwork.ozlabs.org Delivered-To: patchwork-incoming@bilbo.ozlabs.org Received: from huckleberry.canonical.com (huckleberry.canonical.com [91.189.94.19]) by ozlabs.org (Postfix) with ESMTP id C44142C00A4 for ; Thu, 23 May 2013 07:57:23 +1000 (EST) Received: from localhost ([127.0.0.1] helo=huckleberry.canonical.com) by huckleberry.canonical.com with esmtp (Exim 4.76) (envelope-from ) id 1UfH25-0006OW-TE; Wed, 22 May 2013 21:57:17 +0000 Received: from youngberry.canonical.com ([91.189.89.112]) by huckleberry.canonical.com with esmtp (Exim 4.76) (envelope-from ) id 1UfH0N-00051M-BS for kernel-team@lists.ubuntu.com; Wed, 22 May 2013 21:55:31 +0000 Received: from c-67-160-231-42.hsd1.ca.comcast.net ([67.160.231.42] helo=fourier) by youngberry.canonical.com with esmtpsa (TLS1.0:DHE_RSA_AES_128_CBC_SHA1:16) (Exim 4.71) (envelope-from ) id 1UfH0L-00011y-F3; Wed, 22 May 2013 21:55:29 +0000 Received: from kamal by fourier with local (Exim 4.80) (envelope-from ) id 1UfH0J-0006ZK-BU; Wed, 22 May 2013 14:55:27 -0700 From: Kamal Mostafa To: Li Zefan Subject: [ 3.8.y.z extended stable ] Patch "shm: fix null pointer deref when userspace specifies invalid hugepage" has been added to staging queue Date: Wed, 22 May 2013 14:55:27 -0700 Message-Id: <1369259727-25218-1-git-send-email-kamal@canonical.com> X-Mailer: git-send-email 1.8.1.2 X-Extended-Stable: 3.8 Cc: Rik van Riel , Kamal Mostafa , kernel-team@lists.ubuntu.com, Dave Jones , Naoya Horiguchi , Linus Torvalds , Li Zefan X-BeenThere: kernel-team@lists.ubuntu.com X-Mailman-Version: 2.1.14 Precedence: list List-Id: Kernel team discussions List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , MIME-Version: 1.0 Errors-To: kernel-team-bounces@lists.ubuntu.com Sender: kernel-team-bounces@lists.ubuntu.com This is a note to let you know that I have just added a patch titled shm: fix null pointer deref when userspace specifies invalid hugepage to the linux-3.8.y-queue branch of the 3.8.y.z extended stable tree which can be found at: http://kernel.ubuntu.com/git?p=ubuntu/linux.git;a=shortlog;h=refs/heads/linux-3.8.y-queue If you, or anyone else, feels it should not be added to this tree, please reply to this email. For more information about the 3.8.y.z tree, see https://wiki.ubuntu.com/Kernel/Dev/ExtendedStable Thanks. -Kamal ------ From 985aa7674926884d86c2070155d8977c242c8b33 Mon Sep 17 00:00:00 2001 From: Li Zefan Date: Thu, 9 May 2013 15:08:15 +0800 Subject: shm: fix null pointer deref when userspace specifies invalid hugepage size commit 091d0d55b286c9340201b4ed4470be87fc568228 upstream. Dave reported an oops triggered by trinity: BUG: unable to handle kernel NULL pointer dereference at 0000000000000008 IP: newseg+0x10d/0x390 PGD cf8c1067 PUD cf8c2067 PMD 0 Oops: 0000 [#1] PREEMPT SMP DEBUG_PAGEALLOC CPU: 2 PID: 7636 Comm: trinity-child2 Not tainted 3.9.0+#67 ... Call Trace: ipcget+0x182/0x380 SyS_shmget+0x5a/0x60 tracesys+0xdd/0xe2 This bug was introduced by commit af73e4d9506d ("hugetlbfs: fix mmap failure in unaligned size request"). Reported-by: Dave Jones Signed-off-by: Li Zefan Reviewed-by: Naoya Horiguchi Acked-by: Rik van Riel Signed-off-by: Linus Torvalds Signed-off-by: Kamal Mostafa --- ipc/shm.c | 8 +++++++- mm/mmap.c | 8 ++++++-- 2 files changed, 13 insertions(+), 3 deletions(-) -- 1.8.1.2 diff --git a/ipc/shm.c b/ipc/shm.c index 9ec2316..69881fb 100644 --- a/ipc/shm.c +++ b/ipc/shm.c @@ -493,7 +493,13 @@ static int newseg(struct ipc_namespace *ns, struct ipc_params *params) if (shmflg & SHM_HUGETLB) { struct hstate *hs = hstate_sizelog((shmflg >> SHM_HUGE_SHIFT) & SHM_HUGE_MASK); - size_t hugesize = ALIGN(size, huge_page_size(hs)); + size_t hugesize; + + if (!hs) { + error = -EINVAL; + goto no_file; + } + hugesize = ALIGN(size, huge_page_size(hs)); /* hugetlb_file_setup applies strict accounting */ if (shmflg & SHM_NORESERVE) diff --git a/mm/mmap.c b/mm/mmap.c index e6beac4..de254aa 100644 --- a/mm/mmap.c +++ b/mm/mmap.c @@ -1300,9 +1300,13 @@ SYSCALL_DEFINE6(mmap_pgoff, unsigned long, addr, unsigned long, len, len = ALIGN(len, huge_page_size(hstate_file(file))); } else if (flags & MAP_HUGETLB) { struct user_struct *user = NULL; + struct hstate *hs = hstate_sizelog((flags >> MAP_HUGE_SHIFT) & + SHM_HUGE_MASK); - len = ALIGN(len, huge_page_size(hstate_sizelog( - (flags >> MAP_HUGE_SHIFT) & MAP_HUGE_MASK))); + if (!hs) + return -EINVAL; + + len = ALIGN(len, huge_page_size(hs)); /* * VM_NORESERVE is used because the reservations will be * taken when vm_ops->mmap() is called