kernel.git/arch/um, branch linux-3.11.y

uml: check length in exitcode_proc_write()

2013-11-13T03:08:10Z

commit 201f99f170df14ba52ea4c52847779042b7a623b upstream. We don't cap the size of buffer from the user so we could write past the end of the array here. Only root can write to this file. Reported-by: Nico Golde Reported-by: Fabian Yamaguchi Signed-off-by: Dan Carpenter Signed-off-by: Linus Torvalds Signed-off-by: Greg Kroah-Hartman

um: Implement probe_kernel_read()

2013-09-27T00:21:58Z

commit f75b1b1bedfb498cc43a992ce4d7ed8df3b1e770 upstream. UML needs it's own probe_kernel_read() to handle kernel mode faults correctly. The implementation uses mincore() on the host side to detect whether a page is owned by the UML kernel process. This fixes also a possible crash when sysrq-t is used. Starting with 3.10 sysrq-t calls probe_kernel_read() to read details from the kernel workers. As kernel worker are completely async pointers may turn NULL while reading them. Signed-off-by: Richard Weinberger Cc: Cc: Signed-off-by: Greg Kroah-Hartman

Fix TLB gather virtual address range invalidation corner cases

2013-08-16T15:52:46Z

Ben Tebulin reported: "Since v3.7.2 on two independent machines a very specific Git repository fails in 9/10 cases on git-fsck due to an SHA1/memory failures. This only occurs on a very specific repository and can be reproduced stably on two independent laptops. Git mailing list ran out of ideas and for me this looks like some very exotic kernel issue" and bisected the failure to the backport of commit 53a59fc67f97 ("mm: limit mmu_gather batching to fix soft lockups on !CONFIG_PREEMPT"). That commit itself is not actually buggy, but what it does is to make it much more likely to hit the partial TLB invalidation case, since it introduces a new case in tlb_next_batch() that previously only ever happened when running out of memory. The real bug is that the TLB gather virtual memory range setup is subtly buggered. It was introduced in commit 597e1c3580b7 ("mm/mmu_gather: enable tlb flush range in generic mmu_gather"), and the range handling was already fixed at least once in commit e6c495a96ce0 ("mm: fix the TLB range flushed when __tlb_remove_page() runs out of slots"), but that fix was not complete. The problem with the TLB gather virtual address range is that it isn't set up by the initial tlb_gather_mmu() initialization (which didn't get the TLB range information), but it is set up ad-hoc later by the functions that actually flush the TLB. And so any such case that forgot to update the TLB range entries would potentially miss TLB invalidates. Rather than try to figure out exactly which particular ad-hoc range setup was missing (I personally suspect it's the hugetlb case in zap_huge_pmd(), which didn't have the same logic as zap_pte_range() did), this patch just gets rid of the problem at the source: make the TLB range information available to tlb_gather_mmu(), and initialize it when initializing all the other tlb gather fields. This makes the patch larger, but conceptually much simpler. And the end result is much more understandable; even if you want to play games with partial ranges when invalidating the TLB contents in chunks, now the range information is always there, and anybody who doesn't want to bother with it won't introduce subtle bugs. Ben verified that this fixes his problem. Reported-bisected-and-tested-by: Ben Tebulin Build-testing-by: Stephen Rothwell Build-testing-by: Richard Weinberger Reviewed-by: Michal Hocko Acked-by: Peter Zijlstra Cc: stable@vger.kernel.org Signed-off-by: Linus Torvalds

um: siginfo cleanup

2013-07-19T09:31:36Z

Currently we use both struct siginfo and siginfo_t. Let's use struct siginfo internally to avoid ongoing compiler warning. We are allowed to do so because struct siginfo and siginfo_t are equivalent. Signed-off-by: Richard Weinberger

uml: Fix which_tmpdir failure when /dev/shm is a symlink, and in other edge cases

2013-07-19T08:45:18Z

which_tmpdir did the wrong thing if /dev/shm was a symlink (e.g., to /run/shm), if there were multiple mounts on top of each other, if the mount(s) were obscured by a later mount, or if /dev/shm was a prefix of another mount point. This fixes these cases. Applies to 3.9.6. Signed-off-by: Tristan Schmelcher Signed-off-by: Richard Weinberger

um: Fix wait_stub_done() error handling

2013-07-19T08:45:18Z

If we die within a stub handler we only way to reliable kill the (obviously) dying uml guest process is killing it's host twin on the host side. Signed-off-by: Richard Weinberger

um: Mark stub pages mapping with VM_PFNMAP

2013-07-19T08:45:17Z

Ensure that a process cannot destroy his stub pages with using MADV_DONTNEED and friends. Reported-by: toralf.foerster@gmx.de Signed-off-by: Richard Weinberger

um: Fix return value of strnlen_user()

2013-07-19T08:45:17Z

In case of an error it must not return -EFAULT. Return 0 like all other archs do. Reported-by: toralf.foerster@gmx.de Signed-off-by: Richard Weinberger

mm/um: prepare for removing num_physpages and simplify mem_init()

2013-07-03T23:07:37Z

Prepare for removing num_physpages and simplify mem_init(). Signed-off-by: Jiang Liu Cc: Jeff Dike Cc: Richard Weinberger Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds

UML: normalize global variables exported by vmlinux.lds

2013-07-03T23:07:34Z

Normalize global variables exported by vmlinux.lds to conform usage guidelines from include/asm-generic/sections.h. 1) Use _text to mark the start of the kernel image including the head text, and _stext to mark the start of the .text section. 2) Export mandatory global variables __bss_stop. 3) Adjust __init_begin and __init_end to avoid acrossing .text and .data sections. Signed-off-by: Jiang Liu Cc: Jeff Dike Cc: Richard Weinberger Cc: Al Viro Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds