From 88c2a1700c4ce79bc8765557703709dee6c1f31d Mon Sep 17 00:00:00 2001 From: Salvatore Bonaccorso Date: Tue, 23 Jun 2020 15:35:24 +0200 Subject: [PATCH] Drop "mm: Fix mremap not considering huge pmd devmap" --- debian/changelog | 1 - ...emap-not-considering-huge-pmd-devmap.patch | 58 ------------------- debian/patches/series | 1 - 3 files changed, 60 deletions(-) delete mode 100644 debian/patches/bugfix/all/mm-Fix-mremap-not-considering-huge-pmd-devmap.patch diff --git a/debian/changelog b/debian/changelog index 79efde8f3..1b697672c 100644 --- a/debian/changelog +++ b/debian/changelog @@ -444,7 +444,6 @@ linux (4.19.127-1) UNRELEASED; urgency=medium https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.19.127 - Revert "cgroup: Add memory barriers to plug cgroup_rstat_updated() race window" - libnvdimm: Fix endian conversion issues  - - mm: Fix mremap not considering huge pmd devmap - HID: sony: Fix for broken buttons on DS3 USB dongles - HID: i2c-hid: add Schneider SCL142ALM to descriptor override - p54usb: add AirVasT USB stick device-id diff --git a/debian/patches/bugfix/all/mm-Fix-mremap-not-considering-huge-pmd-devmap.patch b/debian/patches/bugfix/all/mm-Fix-mremap-not-considering-huge-pmd-devmap.patch deleted file mode 100644 index 70ec97519..000000000 --- a/debian/patches/bugfix/all/mm-Fix-mremap-not-considering-huge-pmd-devmap.patch +++ /dev/null @@ -1,58 +0,0 @@ -From: Fan Yang -Date: Thu, 4 Jun 2020 18:22:07 +0800 -Subject: mm: Fix mremap not considering huge pmd devmap -Origin: https://git.kernel.org/linus/5bfea2d9b17f1034a68147a8b03b9789af5700f9 -Bug-Debian-Security: https://security-tracker.debian.org/tracker/CVE-2020-10757 - -The original code in mm/mremap.c checks huge pmd by: - - if (is_swap_pmd(*old_pmd) || pmd_trans_huge(*old_pmd)) { - -However, a DAX mapped nvdimm is mapped as huge page (by default) but it -is not transparent huge page (_PAGE_PSE | PAGE_DEVMAP). This commit -changes the condition to include the case. - -This addresses CVE-2020-10757. - -Fixes: 5c7fb56e5e3f ("mm, dax: dax-pmd vs thp-pmd vs hugetlbfs-pmd") -Cc: -Reported-by: Fan Yang -Signed-off-by: Fan Yang -Tested-by: Fan Yang -Tested-by: Dan Williams -Reviewed-by: Dan Williams -Acked-by: Kirill A. Shutemov -Signed-off-by: Linus Torvalds ---- - arch/x86/include/asm/pgtable.h | 1 + - mm/mremap.c | 2 +- - 2 files changed, 2 insertions(+), 1 deletion(-) - -diff --git a/arch/x86/include/asm/pgtable.h b/arch/x86/include/asm/pgtable.h -index f51d8997ed00..b8f46bbe69f4 100644 ---- a/arch/x86/include/asm/pgtable.h -+++ b/arch/x86/include/asm/pgtable.h -@@ -257,6 +257,7 @@ static inline int pmd_large(pmd_t pte) - } - - #ifdef CONFIG_TRANSPARENT_HUGEPAGE -+/* NOTE: when predicate huge page, consider also pmd_devmap, or use pmd_large */ - static inline int pmd_trans_huge(pmd_t pmd) - { - return (pmd_val(pmd) & (_PAGE_PSE|_PAGE_DEVMAP)) == _PAGE_PSE; -diff --git a/mm/mremap.c b/mm/mremap.c -index 6aa6ea605068..57b1f999f789 100644 ---- a/mm/mremap.c -+++ b/mm/mremap.c -@@ -266,7 +266,7 @@ unsigned long move_page_tables(struct vm_area_struct *vma, - new_pmd = alloc_new_pmd(vma->vm_mm, vma, new_addr); - if (!new_pmd) - break; -- if (is_swap_pmd(*old_pmd) || pmd_trans_huge(*old_pmd)) { -+ if (is_swap_pmd(*old_pmd) || pmd_trans_huge(*old_pmd) || pmd_devmap(*old_pmd)) { - if (extent == HPAGE_PMD_SIZE) { - bool moved; - /* See comment in move_ptes() */ --- -2.27.0.rc0 - diff --git a/debian/patches/series b/debian/patches/series index 7b2fed92e..1642f66e6 100644 --- a/debian/patches/series +++ b/debian/patches/series @@ -296,7 +296,6 @@ features/arm/staging-vc04_services-Use-correct-cache-line-size.patch # Security fixes debian/i386-686-pae-pci-set-pci-nobios-by-default.patch debian/ntfs-mark-it-as-broken.patch -bugfix/all/mm-Fix-mremap-not-considering-huge-pmd-devmap.patch bugfix/x86/srbds/0001-x86-cpu-Add-a-steppings-field-to-struct-x86_cpu_id.patch bugfix/x86/srbds/0002-x86-cpu-Add-table-argument-to-cpu_matches.patch bugfix/x86/srbds/0003-x86-speculation-Add-Special-Register-Buffer-Data-Sam.patch