UbiquitousOS
/
OpenCloudOS-Kernel
mirror of https://gitee.com/OpenCloudOS/OpenCloudOS-Kernel.git
11
0
Fork 0
Code Issues Projects Releases Wiki Activity

s390 updates for 6.0-rc3 

- Fix double free of guarded storage and runtime instrumentation control
   blocks on fork() failure.
 
 - Fix triggering write fault when VMA does not allow VM_WRITE.
 -----BEGIN PGP SIGNATURE-----
 
 iQEzBAABCAAdFiEE3QHqV+H2a8xAv27vjYWKoQLXFBgFAmMJ6sYACgkQjYWKoQLX
 FBiH2Af/YzyZO+MgkXEGpMDp7zp7G1H3m7OYfA9onnRruf5PKppWYR/0eQRRYbat
 C1+9LyIQO2PjMG0RoWroxX7DYG9HR027nt1D+J1xPk82UgGvegDkky3oH3c75wFb
 oxjjdSI+Rsb4VEo1yIaKfl+lEsxa+rqXB3wvSsrwMFs9OHJYQo4eK62WUAFwcDoq
 saZ5xu82GhACTETpzCFnVHdGyWdq4BfpQPV1xIQDt8V+8y/yK4/dnB8coGEJL6I1
 cBVPUXltCwXeVoeMTVzzD6qUU0TK9nwHmJneSJ/Afj2w2XfAfJlNYpBuSEUSwHS4
 pD9DzBKy8YQn9ecDmqnDN7zY5n1fFw==
 =wHSL
 -----END PGP SIGNATURE-----

Merge tag 's390-6.0-2' of git://git.kernel.org/pub/scm/linux/kernel/git/s390/linux

Pull s390 fixes from Vasily Gorbik:

 - Fix double free of guarded storage and runtime instrumentation
   control blocks on fork() failure

 - Fix triggering write fault when VMA does not allow VM_WRITE

* tag 's390-6.0-2' of git://git.kernel.org/pub/scm/linux/kernel/git/s390/linux:
  s390/mm: do not trigger write fault when vma does not allow VM_WRITE
  s390: fix double free of GS and RI CBs on fork() failure
This commit is contained in:
Linus Torvalds 2022-08-27 15:40:51 -07:00
parent 05519f2480 41ac42f137
commit dee1873796
2 changed files with 19 additions and 7 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

22
arch/s390/kernel/process.c
View File

@ -91,6 +91,18 @@ int arch_dup_task_struct(struct task_struct *dst, struct task_struct *src)
memcpy(dst, src, arch_task_struct_size);
dst->thread.fpu.regs = dst->thread.fpu.fprs;
/*
* Don't transfer over the runtime instrumentation or the guarded
* storage control block pointers. These fields are cleared here instead
* of in copy_thread() to avoid premature freeing of associated memory
* on fork() failure. Wait to clear the RI flag because ->stack still
* refers to the source thread.
*/
dst->thread.ri_cb = NULL;
dst->thread.gs_cb = NULL;
dst->thread.gs_bc_cb = NULL;
return 0;
}
@ -150,13 +162,11 @@ int copy_thread(struct task_struct *p, const struct kernel_clone_args *args)
frame->childregs.flags = 0;
if (new_stackp)
frame->childregs.gprs[15] = new_stackp;
/* Don't copy runtime instrumentation info */
p->thread.ri_cb = NULL;
/*
* Clear the runtime instrumentation flag after the above childregs
* copy. The CB pointer was already cleared in arch_dup_task_struct().
*/
frame->childregs.psw.mask &= ~PSW_MASK_RI;
/* Don't copy guarded storage control block */
p->thread.gs_cb = NULL;
p->thread.gs_bc_cb = NULL;
/* Set a new TLS ? */
if (clone_flags & CLONE_SETTLS) {

4
arch/s390/mm/fault.c
View File

@ -379,7 +379,9 @@ static inline vm_fault_t do_exception(struct pt_regs *regs, int access)
flags = FAULT_FLAG_DEFAULT;
if (user_mode(regs))
flags |= FAULT_FLAG_USER;
if (access == VM_WRITE || is_write)
if (is_write)
access = VM_WRITE;
if (access == VM_WRITE)
flags |= FAULT_FLAG_WRITE;
mmap_read_lock(mm);