mirror of
https://github.com/AuxXxilium/linux_dsm_epyc7002.git
synced 2025-02-26 04:22:36 +07:00
fdd97c4568
commit 7780918b36489f0b2f9a3749d7be00c2ceaec513 upstream.
Back in 2.1.29 the clear_user() guts (__bzero()) had been merged
with memset(). Unfortunately, while all exception handlers had been
copied, one of the exception table entries got lost. As the result,
clear_user() starting at 128*n bytes before the end of page and
spanning between 8 and 127 bytes into the next page would oops when
the second page is unmapped. It's trivial to reproduce - all
it takes is
main()
{
int fd = open("/dev/zero", O_RDONLY);
char *p = mmap(NULL, 16384, PROT_READ|PROT_WRITE,
MAP_PRIVATE|MAP_ANON, -1, 0);
munmap(p + 8192, 8192);
read(fd, p + 8192 - 128, 192);
}
which had been oopsing since March 1997. Says something about
the quality of test coverage... ;-/ And while today sparc32 port
is nearly dead, back in '97 it had been very much alive; in fact,
sparc64 had only been in mainline for 3 months by that point...
Cc: stable@kernel.org
Fixes: v2.1.29
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
|
||
|---|---|---|
| .. | ||
| ashldi3.S | ||
| ashrdi3.S | ||
| atomic32.c | ||
| atomic_64.S | ||
| bitext.c | ||
| bitops.S | ||
| blockops.S | ||
| bzero.S | ||
| checksum_32.S | ||
| checksum_64.S | ||
| clear_page.S | ||
| cmpdi2.c | ||
| copy_in_user.S | ||
| copy_page.S | ||
| copy_user.S | ||
| csum_copy_from_user.S | ||
| csum_copy_to_user.S | ||
| csum_copy.S | ||
| divdi3.S | ||
| ffs.S | ||
| fls64.S | ||
| fls.S | ||
| GENbzero.S | ||
| GENcopy_from_user.S | ||
| GENcopy_to_user.S | ||
| GENmemcpy.S | ||
| GENpage.S | ||
| GENpatch.S | ||
| hweight.S | ||
| iomap.c | ||
| ipcsum.S | ||
| libgcc.h | ||
| locks.S | ||
| lshrdi3.S | ||
| M7copy_from_user.S | ||
| M7copy_to_user.S | ||
| M7memcpy.S | ||
| M7memset.S | ||
| M7patch.S | ||
| Makefile | ||
| mcount.S | ||
| memcmp.S | ||
| Memcpy_utils.S | ||
| memcpy.S | ||
| memmove.S | ||
| memscan_32.S | ||
| memscan_64.S | ||
| memset.S | ||
| muldi3.S | ||
| multi3.S | ||
| NG2copy_from_user.S | ||
| NG2copy_to_user.S | ||
| NG2memcpy.S | ||
| NG2patch.S | ||
| NG4clear_page.S | ||
| NG4copy_from_user.S | ||
| NG4copy_page.S | ||
| NG4copy_to_user.S | ||
| NG4fls.S | ||
| NG4memcpy.S | ||
| NG4memset.S | ||
| NG4patch.S | ||
| NGbzero.S | ||
| NGcopy_from_user.S | ||
| NGcopy_to_user.S | ||
| NGmemcpy.S | ||
| NGpage.S | ||
| NGpatch.S | ||
| PeeCeeI.c | ||
| strlen.S | ||
| strncmp_32.S | ||
| strncmp_64.S | ||
| U1copy_from_user.S | ||
| U1copy_to_user.S | ||
| U1memcpy.S | ||
| U3copy_from_user.S | ||
| U3copy_to_user.S | ||
| U3memcpy.S | ||
| U3patch.S | ||
| ucmpdi2.c | ||
| udivdi3.S | ||
| VISsave.S | ||
| xor.S | ||