Merge branch 'akpm' (patches from Andrew)

Merge misc fixes from Andrew Morton: "8 patches. Subsystems affected by this patch series: mm (hugetlb, pagemap, and userfaultfd), memfd, selftests, and kconfig" * emailed patches from Andrew Morton <akpm@linux-foundation.org>: configs/debug: set CONFIG_DEBUG_INFO=y properly proc: fix documentation and description of pagemap kselftest/vm: fix tests build with old libc memfd: fix F_SEAL_WRITE after shmem huge page allocated mm: fix use-after-free when anon vma name is used after vma is freed mm: prevent vm_area_struct::anon_name refcount saturation mm: refactor vm_area_struct::anon_vma_name usage code selftests/vm: cleanup hugetlb file after mremap test

Linus Torvalds committed 4 years ago

Commit 00144042 parents f9026e1 d1eff1618 files · +194 −137Browse files

Showing the changes to kernel (3 of 18 files). Show all

Unified · Split

3 files

kernel/configs/debug.config +1 −1
kernel/fork.c +2 −2
kernel/sys.c +12 −7

kernel/configs/debug.config+1−1

@@ -16,7 +16,7 @@ CONFIG_SYMBOLIC_ERRNAME=y · 15 unmodified lines
16	16	#
17	17	# Compile-time checks and compiler options
18	18	#
19		−CONFIG_DEBUG_INFO=y
	19	+CONFIG_DEBUG_INFO_DWARF_TOOLCHAIN_DEFAULT=y
20	20	CONFIG_DEBUG_SECTION_MISMATCH=y
21	21	CONFIG_FRAME_WARN=2048
22	22	CONFIG_SECTION_MISMATCH_WARN_ONLY=y

kernel/fork.c+2−2

@@ -366,14 +366,14 @@ struct vm_area_struct vm_area_dup(struct vm_area_struct orig) · 365 unmodified lines
366	366	new = data_race(orig);
367	367	INIT_LIST_HEAD(&new->anon_vma_chain);
368	368	new->vm_next = new->vm_prev = NULL;
369		− dup_vma_anon_name(orig, new);
	369	+ dup_anon_vma_name(orig, new);
370	370	}
371	371	return new;
372	372	}
373	373
374	374	void vm_area_free(struct vm_area_struct *vma)
375	375	{
376		− free_vma_anon_name(vma);
	376	+ free_anon_vma_name(vma);
377	377	kmem_cache_free(vm_area_cachep, vma);
378	378	}
379	379

kernel/sys.c+12−7

@@ -7,6 +7,7 @@ · 6 unmodified lines
7	7
8	8	#include <linux/export.h>
9	9	#include <linux/mm.h>
	10	+#include <linux/mm_inline.h>
10	11	#include <linux/utsname.h>
11	12	#include <linux/mman.h>
12	13	#include <linux/reboot.h>
@@ -2286,15 +2287,16 @@ static int prctl_set_vma(unsigned long opt, unsigned long addr, · 2273 unmodified lines
2286	2287	{
2287	2288	struct mm_struct *mm = current->mm;
2288	2289	const char __user *uname;
2289		− char name, pch;
	2290	+ struct anon_vma_name *anon_name = NULL;
2290	2291	int error;
2291	2292
2292	2293	switch (opt) {
2293	2294	case PR_SET_VMA_ANON_NAME:
2294	2295	uname = (const char __user *)arg;
2295	2296	if (uname) {
2296		− name = strndup_user(uname, ANON_VMA_NAME_MAX_LEN);
	2297	+ char name, pch;
2297	2298
	2299	+ name = strndup_user(uname, ANON_VMA_NAME_MAX_LEN);
2298	2300	if (IS_ERR(name))
2299	2301	return PTR_ERR(name);
2300	2302
@@ -2304,15 +2306,18 @@ static int prctl_set_vma(unsigned long opt, unsigned long addr, · 3 unmodified lines
2304	2306	return -EINVAL;
2305	2307	}
2306	2308	}
2307		− } else {
2308		− /* Reset the name */
2309		− name = NULL;
	2309	+ /* anon_vma has its own copy */
	2310	+ anon_name = anon_vma_name_alloc(name);
	2311	+ kfree(name);
	2312	+ if (!anon_name)
	2313	+ return -ENOMEM;
	2314	+
2310	2315	}
2311	2316
2312	2317	mmap_write_lock(mm);
2313		− error = madvise_set_anon_name(mm, addr, size, name);
	2318	+ error = madvise_set_anon_name(mm, addr, size, anon_name);
2314	2319	mmap_write_unlock(mm);
2315		− kfree(name);
	2320	+ anon_vma_name_put(anon_name);
2316	2321	break;
2317	2322	default:
2318	2323	error = -EINVAL;