Commit dee18737 authored by Linus Torvalds's avatar Linus Torvalds
Browse files

Merge tag 's390-6.0-2' of git://git.kernel.org/pub/scm/linux/kernel/git/s390/linux 

Pull s390 fixes from Vasily Gorbik:

 - Fix double free of guarded storage and runtime instrumentation
   control blocks on fork() failure

 - Fix triggering write fault when VMA does not allow VM_WRITE

* tag 's390-6.0-2' of git://git.kernel.org/pub/scm/linux/kernel/git/s390/linux:
  s390/mm: do not trigger write fault when vma does not allow VM_WRITE
  s390: fix double free of GS and RI CBs on fork() failure
parents 05519f24 41ac42f1

arch/s390/kernel/process.c

+16 −6
Original line number Diff line number Diff line
@@ -91,6 +91,18 @@ int arch_dup_task_struct(struct task_struct *dst, struct task_struct *src) 


	memcpy(dst, src, arch_task_struct_size);

	dst->thread.fpu.regs = dst->thread.fpu.fprs;



	/*

	 * Don't transfer over the runtime instrumentation or the guarded

	 * storage control block pointers. These fields are cleared here instead

	 * of in copy_thread() to avoid premature freeing of associated memory

	 * on fork() failure. Wait to clear the RI flag because ->stack still

	 * refers to the source thread.

	 */

	dst->thread.ri_cb = NULL;

	dst->thread.gs_cb = NULL;

	dst->thread.gs_bc_cb = NULL;



	return 0;

}
@@ -150,13 +162,11 @@ int copy_thread(struct task_struct *p, const struct kernel_clone_args *args) 
	frame->childregs.flags = 0;

	if (new_stackp)

		frame->childregs.gprs[15] = new_stackp;



	/* Don't copy runtime instrumentation info */

	p->thread.ri_cb = NULL;

	/*

	 * Clear the runtime instrumentation flag after the above childregs

	 * copy. The CB pointer was already cleared in arch_dup_task_struct().

	 */

	frame->childregs.psw.mask &= ~PSW_MASK_RI;

	/* Don't copy guarded storage control block */

	p->thread.gs_cb = NULL;

	p->thread.gs_bc_cb = NULL;



	/* Set a new TLS ?  */

	if (clone_flags & CLONE_SETTLS) {

arch/s390/mm/fault.c

+3 −1
Original line number Diff line number Diff line
@@ -379,7 +379,9 @@ static inline vm_fault_t do_exception(struct pt_regs *regs, int access) 
	flags = FAULT_FLAG_DEFAULT;

	if (user_mode(regs))

		flags |= FAULT_FLAG_USER;

	if (access == VM_WRITE || is_write)

	if (is_write)

		access = VM_WRITE;

	if (access == VM_WRITE)

		flags |= FAULT_FLAG_WRITE;

	mmap_read_lock(mm);