tree 9ee3b5c89fa9dcd55c9a3e24c70f3bcfef06d7ec
parent 0f0f94052edd2f2f214cc3f0c40ae50610410751
author Jann Horn <jannh@google.com> 1510617824 +0100
committer ChromeOS Commit Bot <chromeos-commit-bot@chromium.org> 1512017697 +0000

UPSTREAM: mm/pagewalk.c: report holes in hugetlb ranges

commit 373c4557d2aa362702c4c2d41288fb1e54990b7c upstream.

This matters at least for the mincore syscall, which will otherwise copy
uninitialized memory from the page allocator to userspace.  It is
probably also a correctness error for /proc/$pid/pagemap, but I haven't
tested that.

Removing the `walk->hugetlb_entry` condition in walk_hugetlb_range() has
no effect because the caller already checks for that.

This only reports holes in hugetlb ranges to callers who have specified
a hugetlb_entry callback.

This issue was found using an AFL-based fuzzer.

v2:
 - don't crash on ->pte_hole==NULL (Andrew Morton)
 - add Cc stable (Andrew Morton)

Changed for 4.4/4.9 stable backport:
 - fix up conflict in the huge_pte_offset() call

BUG=chromium:789497
TEST=Build and run

Change-Id: I80dfb0d9681f16b020740a842b5bcfbe00f8952c
Fixes: 1e25a271c8ac ("mincore: apply page table walker on do_mincore()")
Signed-off-by: Jann Horn <jannh@google.com>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Guenter Roeck <groeck@chromium.org>
(cherry picked from commit a3805b10de80)
Reviewed-on: https://chromium-review.googlesource.com/798471
Commit-Queue: Daniel Wang <wonderfly@google.com>
Tested-by: Daniel Wang <wonderfly@google.com>