[kernel] r16159 - in dists/lenny-security/linux-2.6/debian/patches: bugfix/all features/all/openvz features/all/vserver series

Wed Aug 18 18:38:38 UTC 2010

Author: dannf
Date: Wed Aug 18 18:38:31 2010
New Revision: 16159

Log:
mm: fix page table unmap for stack guard page properly
Also update openvz/vserver patches to apply

Added:
   dists/lenny-security/linux-2.6/debian/patches/bugfix/all/mm-fix-page-table-unmap-for-stack-guard-page-properly.patch
Modified:
   dists/lenny-security/linux-2.6/debian/patches/features/all/openvz/openvz.patch
   dists/lenny-security/linux-2.6/debian/patches/features/all/vserver/vs2.3.0.35.patch
   dists/lenny-security/linux-2.6/debian/patches/series/24lenny1

Added: dists/lenny-security/linux-2.6/debian/patches/bugfix/all/mm-fix-page-table-unmap-for-stack-guard-page-properly.patch
==============================================================================

--- /dev/null	00:00:00 1970	(empty, because file is newly added)
+++ dists/lenny-security/linux-2.6/debian/patches/bugfix/all/mm-fix-page-table-unmap-for-stack-guard-page-properly.patch	Wed Aug 18 18:38:31 2010	(r16159)
@@ -0,0 +1,58 @@
+commit 2972a92225fb59f0b02adbbd5c0f1f22c58a2adb
+Author: Linus Torvalds <torvalds at linux-foundation.org>
+Date:   Sat Aug 14 11:44:56 2010 -0700
+
+    mm: fix page table unmap for stack guard page properly
+    
+    [Backported to Debian's 2.6.26 by dann frazier <dannf at debian.org>]
+    
+    We do in fact need to unmap the page table _before_ doing the whole
+    stack guard page logic, because if it is needed (mainly 32-bit x86 with
+    PAE and CONFIG_HIGHPTE, but other architectures may use it too) then it
+    will do a kmap_atomic/kunmap_atomic.
+    
+    And those kmaps will create an atomic region that we cannot do
+    allocations in.  However, the whole stack expand code will need to do
+    anon_vma_prepare() and vma_lock_anon_vma() and they cannot do that in an
+    atomic region.
+    
+    Now, a better model might actually be to do the anon_vma_prepare() when
+    _creating_ a VM_GROWSDOWN segment, and not have to worry about any of
+    this at page fault time.  But in the meantime, this is the
+    straightforward fix for the issue.
+    
+    See https://bugzilla.kernel.org/show_bug.cgi?id=16588 for details.
+    
+    Reported-by: Wylda <wylda at volny.cz>
+    Reported-by: Sedat Dilek <sedat.dilek at gmail.com>
+    Reported-by: Mike Pagano <mpagano at gentoo.org>
+    Reported-by: François Valenduc <francois.valenduc at tvcablenet.be>
+    Tested-by: Ed Tomlinson <edt at aei.ca>
+    Cc: Pekka Enberg <penberg at kernel.org>
+    Cc: Greg KH <gregkh at suse.de>
+    Cc: stable at kernel.org
+    Signed-off-by: Linus Torvalds <torvalds at linux-foundation.org>
+
+diff --git a/mm/memory.c b/mm/memory.c
+index 659776b..12018e7 100644
+--- a/mm/memory.c
++++ b/mm/memory.c
+@@ -2309,14 +2309,13 @@ static int do_anonymous_page(struct mm_struct *mm, struct vm_area_struct *vma,
+ 	spinlock_t *ptl;
+ 	pte_t entry;
+ 
+-	if (check_stack_guard_page(vma, address) < 0) {
+-		pte_unmap(page_table);
++	pte_unmap(page_table);
++
++	/* Check if we need to add a guard page to the stack */
++	if (check_stack_guard_page(vma, address) < 0)
+ 		return VM_FAULT_SIGBUS;
+-	}
+ 
+ 	/* Allocate our own private page. */
+-	pte_unmap(page_table);
+-
+ 	if (unlikely(anon_vma_prepare(vma)))
+ 		goto oom;
+ 	page = alloc_zeroed_user_highpage_movable(vma, address);

Modified: dists/lenny-security/linux-2.6/debian/patches/features/all/openvz/openvz.patch
==============================================================================
--- dists/lenny-security/linux-2.6/debian/patches/features/all/openvz/openvz.patch	Wed Aug 18 02:58:09 2010	(r16158)
+++ dists/lenny-security/linux-2.6/debian/patches/features/all/openvz/openvz.patch	Wed Aug 18 18:38:31 2010	(r16159)
@@ -67110,18 +67110,18 @@
  	pte_t entry;
 +	struct page_beancounter *pbc;
  
+ 	pte_unmap(page_table);
+ 
+@@ -2315,6 +2398,9 @@ static int do_anonymous_page(struct mm_s
  	if (check_stack_guard_page(vma, address) < 0)
  		return VM_FAULT_SIGBUS;
-@@ -2315,6 +2398,9 @@ static int do_anonymous_page(struct mm_s
- 	/* Allocate our own private page. */
- 	pte_unmap(page_table);
  
 +	if (unlikely(pb_alloc(&pbc)))
 +		goto oom_nopb;
 +
+ 	/* Allocate our own private page. */
  	if (unlikely(anon_vma_prepare(vma)))
  		goto oom;
- 	page = alloc_zeroed_user_highpage_movable(vma, address);
 @@ -2311,11 +2397,14 @@ static int do_anonymous_page(struct mm_struct *mm, struct vm_area_struct *vma,
  	inc_mm_counter(mm, anon_rss);
  	lru_cache_add_active(page);

Modified: dists/lenny-security/linux-2.6/debian/patches/features/all/vserver/vs2.3.0.35.patch
==============================================================================
--- dists/lenny-security/linux-2.6/debian/patches/features/all/vserver/vs2.3.0.35.patch	Wed Aug 18 02:58:09 2010	(r16158)
+++ dists/lenny-security/linux-2.6/debian/patches/features/all/vserver/vs2.3.0.35.patch	Wed Aug 18 18:38:31 2010	(r16159)
@@ -25763,10 +25763,10 @@
  	mark_page_accessed(page);
  	lock_page(page);
  	delayacct_clear_flag(DELAYACCT_PF_SWAPIN);
-@@ -2292,6 +2300,8 @@ static int do_anonymous_page(struct mm_s
- 	/* Allocate our own private page. */
- 	pte_unmap(page_table);
+@@ -2316,6 +2324,8 @@ static int do_anonymous_page(struct mm_s
+ 		return VM_FAULT_SIGBUS;
  
+ 	/* Allocate our own private page. */
 +	if (!vx_rss_avail(mm, 1))
 +		goto oom;
  	if (unlikely(anon_vma_prepare(vma)))

Modified: dists/lenny-security/linux-2.6/debian/patches/series/24lenny1
==============================================================================
--- dists/lenny-security/linux-2.6/debian/patches/series/24lenny1	Wed Aug 18 02:58:09 2010	(r16158)
+++ dists/lenny-security/linux-2.6/debian/patches/series/24lenny1	Wed Aug 18 18:38:31 2010	(r16159)
@@ -11,3 +11,4 @@
 + bugfix/all/mm-fix-missing-page-table-unmap-for-stack-guard-page-failure-case.patch
 + bugfix/x86/dont-send-SIGBUS-for-kernel-page-faults.patch
 + bugfix/all/mm-pass-correct-mm-when-growing-stack.patch
++ bugfix/all/mm-fix-page-table-unmap-for-stack-guard-page-properly.patch

