patch powerpc-fix-size-check-for-hugetlbfs.patch queued to -stable tree
From: <gregkh@suse.de>
Date: 2007-08-13 23:42:25
This is a note to let you know that we have just queued up the patch titled
Subject: powerpc: Fix size check for hugetlbfs
to the 2.6.22-stable tree. Its filename is
powerpc-fix-size-check-for-hugetlbfs.patch
A git repo of this tree can be found at
http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary
From benh@kernel.crashing.org Mon Aug 13 16:17:09 2007
From: Benjamin Herrenschmidt <benh@kernel.crashing.org> Date: Wed, 08 Aug 2007 15:44:15 +1000 Subject: powerpc: Fix size check for hugetlbfs To: linuxppc-dev list <redacted> Cc: Paul Mackerras <redacted>, stable@kernel.org Message-ID: [ref] From: Benjamin Herrenschmidt <benh@kernel.crashing.org> My "slices" address space management code that was added in 2.6.22 implementation of get_unmapped_area() doesn't properly check that the size is a multiple of the requested page size. This allows userland to create VMAs that aren't a multiple of the huge page size with hugetlbfs (since hugetlbfs entirely relies on get_unmapped_area() to do that checking) which leads to a kernel BUG() when such areas are torn down. Signed-off-by: Benjamin Herrenschmidt <benh@kernel.crashing.org> Signed-off-by: Paul Mackerras <redacted> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
--- linux-work.orig/arch/powerpc/mm/slice.c 2007-08-08 15:16:06.000000000 +1000
+++ linux-work/arch/powerpc/mm/slice.c 2007-08-08 15:16:41.000000000 +1000@@ -405,6 +405,8 @@ unsigned long slice_get_unmapped_area(un if (len > mm->task_size) return -ENOMEM; + if (len & ((1ul << pshift) - 1)) + return -EINVAL; if (fixed && (addr & ((1ul << pshift) - 1))) return -EINVAL; if (fixed && addr > (mm->task_size - len))
_______________________________________________ stable mailing list stable@linux.kernel.org http://linux.kernel.org/mailman/listinfo/stable Patches currently in stable-queue which might be from benh@kernel.crashing.org are queue-2.6.22/ppc-revert-don-t-complain-if-size-cells-0-in-prom_parse.patch queue-2.6.22/ppc-revert-add-mdio-to-bus-scan-id-list-for-platforms-with-qe-uec.patch queue-2.6.22/powerpc-fix-size-check-for-hugetlbfs.patch