Re: Please include commit 90481622d7 in 3.3-stable

On Thu, 2012-05-10 at 19:58 +1000, Paul Mackerras wrote:

Please include commit 90481622d7 ("hugepages: fix use after free bug
in "quota" handling") from Linus' tree in the next 3.3 stable release.
It applies without fuzz, though with offsets.

It fixes a use-after-free bug in the huge page code that we are
hitting when using KVM on IBM Power machines with large pages backing
the guests, though it can in principle be hit in other ways also.
Since it's a use-after-free bug, it tends to result in an immediate
kernel crash if you have slab debug turned on, or occasional
hard-to-debug memory corruption if you don't.

The bug is also present in earlier kernels, and the patch should
apply at least to 3.2.  It would be good if it can be applied to
earlier kernels also.

I tried cherry-picking this on top of 3.2.17, but there was a conflict
in unmap_ref_private().  It looks like all of these belong in 3.2.y as
well:

1e16a53 mm/hugetlb.c: fix virtual address handling in hugetlb fault
0c176d5 mm: hugetlb: fix pgoff computation when unmapping page from vma
ea5768c mm/hugetlb.c: avoid bogus counter of surplus huge page
409eb8c mm/hugetlb.c: undo change to page mapcount in fault handler
cd2934a flush_tlb_range() needs ->page_table_lock when ->mmap_sem is not held

Ben.

-- 
Ben Hutchings
Experience is directly proportional to the value of equipment destroyed.
                                                         - Carolyn Scheppner